Free Security Headers Checker
Review the response headers that help browsers enforce transport security, framing protections, content restrictions, MIME sniffing controls, and referrer privacy.
Common use cases
- Audit a new website before launch for missing browser security headers.
- Confirm HSTS, CSP, X-Frame-Options, and related headers after a deploy.
- Collect quick evidence for hardening tickets and security reviews.
The security-headers check fetches the public response, follows the final destination, and reviews browser-enforced protections such as HSTS, Content Security Policy, framing controls, MIME-sniffing protection, and referrer policy.
Prioritize headers by consequence
Start with reliable HTTPS, then deploy HSTS only when the covered hosts are ready. Introduce Content Security Policy in report-only mode when the application has complex scripts, frames, or third-party resources.
- Use CSP frame-ancestors or X-Frame-Options to restrict unwanted framing.
- Set X-Content-Type-Options: nosniff for predictable content handling.
- Choose Referrer-Policy and Permissions-Policy values that match actual product requirements.
A missing header is not automatically a vulnerability
Risk depends on the application, content, browser behavior, and deployment context. Treat the report as a hardening review and test changes in the real application before enforcing restrictive policies.
- Inspect the final HTML response rather than assuming every asset needs the same policy.
- Avoid copying an HSTS preload configuration without understanding subdomain consequences.
- Retest after CDN, proxy, framework, or hosting changes.
Standards and further reading
Diagnostic output is evidence, not a guarantee of security, deliverability, availability, or search ranking. Read the NerdTools methodology and limitations before making consequential changes.
Frequently asked questions
Which security headers are checked?
The checker reports common headers including HSTS, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and related controls.
Does it make a GET request?
NerdTools tries a HEAD request first and falls back to GET when the server does not return enough information.