Skip to main content

Security Headers Checker

Analyse your website's HTTP security headers and get recommendations for improving your security posture.

  • Check security headers
  • Security score and grade
  • View missing headers
  • Improve website security
Enter the domain without https://. We read the headers the site is serving right now.

Why security headers matter

Security headers are HTTP response headers that tell the browser how to behave when handling your site, defending visitors against cross-site scripting, clickjacking and other common attacks. They cost nothing to add and take minutes to set up.

What we check

Six essential headers: Strict-Transport-Security, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy and Permissions-Policy.

How scoring works

Each header contributes to a score out of 100, which maps to a grade from A to F. The colour tells you at a glance whether your defence needs attention.

Fix it in minutes

Copy a ready-made configuration for .htaccess, Nginx, PHP, CFML or Node.js, add it to your site, then rescan to confirm the improvement.

Further reading

Frequently Asked Questions

Can't find the answers below, contact one of our friendly team

They are instructions a website sends with every response that tell the browser how to behave more safely, for example enforcing HTTPS, blocking your site being framed, or restricting where scripts may load from. They are a simple, high-impact layer of defence.

The tool checks for six widely recommended headers: Strict-Transport-Security, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy and Permissions-Policy. Each carries a weighting, and the total maps to a grade from A to F.

The results include ready-to-use configuration for Apache, Nginx, PHP, CFML and Node.js. Copy the block for your stack into your server or application configuration, then re-scan to confirm. Test a strict Content-Security-Policy carefully, as it can block legitimate resources.

Our platform makes it straightforward to add security headers, and our team can advise on a policy that fits your site. See our security page for how we approach hardening.

Hardening done for you.

Every Host Media server is hardened as standard, and on managed hosting our team will add and tune security headers for you, so your site stays protected without the homework.

Our security practices Talk to the team