# IndieHeaders

> Check the security headers a public site sends: HSTS, CSP, framing, content type, referrer, and permissions, with the line to add for each gap.

See which security headers your site sends, and the exact line for each one missing.

The canonical page is https://indieheaders.com/.

## Use the tool

Open [IndieHeaders](https://indieheaders.com/) to complete the job. The questions below describe the supported input, result, and limits. Every answer names its source next to it.

Source: [MDN Web Docs, HTTP headers](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers).

## Questions and limits

### What are HTTP security headers?

Security headers are lines a server adds to every response that tell the browser how to treat the page: use HTTPS only, load scripts only from these places, do not let another site frame this page, trust the declared file type, limit what the address reveals to other sites, and keep the camera and microphone off. They cost nothing to send and close the most common ways a small site is hijacked. [MDN](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers) documents each one.

### Which headers does IndieHeaders check?

Six: `Strict-Transport-Security`, `Content-Security-Policy`, framing through `X-Frame-Options` or `frame-ancestors`, `X-Content-Type-Options`, `Referrer-Policy`, and `Permissions-Policy`. Each row shows the value found, whether it is present, weak, or missing, and the exact line to add. The check also requests the plain `http://` address once to see whether it redirects to HTTPS, reads a Content-Security-Policy or referrer `meta` tag in the HTML, and notes `Server`, `X-Powered-By`, and `X-XSS-Protection` when they appear.

### What does a weak header mean?

The header is sent, but its value does not do the job. Examples the check names: an HSTS `max-age` under six months, a policy that is report-only, a Content-Security-Policy with `'unsafe-inline'` in the script sources and no nonce or hash, a `Referrer-Policy` of `unsafe-url`, an obsolete `X-Frame-Options: ALLOW-FROM`, or the old `Feature-Policy` name. A weak row gets the same fix line as a missing one.

### How do I add security headers to my site?

Copy the lines from the result, or download them as a `_headers` file for Cloudflare Pages and Netlify, a `vercel.json` for Vercel, or `add_header` directives for Nginx. Every line carries what it can change on a working site. Start with the safe ones, `X-Content-Type-Options` and `Referrer-Policy`, then HSTS once every subdomain serves HTTPS. Deploy, and check again: results are cached for five minutes, so a fix shows quickly.

Test a Content-Security-Policy as `Content-Security-Policy-Report-Only` before you enforce it. The suggested line, `default-src 'self'; frame-ancestors 'none'`, blocks every script, style, font, and image from another origin and every inline script, so list the origins and the inline code your pages need, then switch the header name back.

### What is HSTS and do I need it?

HTTP Strict Transport Security is one header, `Strict-Transport-Security: max-age=31536000`, that tells a browser to use HTTPS for this host for the next year without asking. Without it, a visitor who types your domain starts on plain HTTP, and a network on the way can serve a changed copy before the redirect. Every site on HTTPS should send it. Browsers read it only over HTTPS, so the redirect from plain HTTP has to exist first, and the check probes that.

`includeSubDomains` extends the rule to every subdomain, so add it only after each one serves HTTPS. Once a browser has seen the header it refuses plain HTTP for a year, which is the point, and also why a wrong value is slow to undo.

### Does passing this check make my site secure?

No. Six headers with sound values close a class of browser-side attacks, and that is all the check claims. It reads one response from Cloudflare's network with a plain user agent. It does not run the page, test whether a policy really blocks anything, or scan for vulnerabilities in your code or your dependencies. A CDN, a firewall, or a login page can also answer this check differently from a real visitor.

## Promises

- The core is free: no account, no card, no premium plan, no upgrade nag, no hidden paywall.
- Private lookup activity is never published.
- Analytics is currently off. Private lookup activity is never published or sent to a tracker. No lookup history becomes public inventory.

## More

- [Notes](https://indieheaders.com/blog.md): posts by the maker, newest first
- [More tools](https://indieheaders.com/tools.md): the other tools by turushan
- [security.txt](https://indieheaders.com/.well-known/security.txt): how to report a vulnerability

Made by turushan, https://twitter.com/turushan.