Tools · Web

WEBSITE SECURITY HEADERS

We read the response headers like a browser and go through those that decide how the page behaves. Each comes with what it guards and what happens without it.

Security headers are instructions the site sends to the browser along with the page. They decide what the page may load, who may put it in a frame and how strictly an encrypted connection is enforced. The check shows which of them the address you enter sends and which it does not.

Every finding describes what the header is supposed to do and why — not a ready-made configuration block to copy. The content policy depends on the specific application, and one taken from elsewhere either breaks features or protects against nothing. The request goes out from our server. Besides the address you enter, any redirect and the unencrypted variant on port 80 are read as well; the number of checks is limited.

The result is indicative The tool looks at the headers of one response at one moment, the way a visitor who is not logged in sees them. It does not crawl further pages, does not test for vulnerabilities, does not get past a login and does not see what happens inside the application. Headers being set does not mean the site is secure, and a missing header does not mean it is vulnerable. The configuration can also differ by path, by language version and by whether the response comes from the application or from a cache in front of it.

Enter a publicly reachable address. If you leave out the protocol, https is tried. Addresses inside internal networks are rejected deliberately.

Other tools

Email domain security SPF, DKIM and DMARC from public DNS. Can fraudulent mail be sent in the name of your domain? Is your password in a breach? A comparison against a list of passwords from public breaches. Runs entirely in the browser.
Content valid as of 8 August 2026

Headers are the first layer

Headers show how the site is built. Not what is inside it.

The check goes through one address. The site including its application logic, its logins and the settings of the servers can be gone through as part of a security assessment.

Write to us →