Free security headers checker: HSTS, CSP, clickjacking and more
Type an address to see which of the five standard security headers its server sends with every page, and whether it forces HTTPS. Each missing header is usually a one-line setting at the host or CDN.
Free, and only reads what any visitor can see.
What it checks
- Strict-Transport-Security, which forces HTTPS
- Content-Security-Policy, which limits what scripts can run
- Clickjacking protection, through X-Frame-Options or frame-ancestors
- X-Content-Type-Options and Referrer-Policy
- Whether the http:// address still loads, and insecure resources on a secure page
- Session cookies without the Secure or HttpOnly flag, and a public server version
Reading the result
- Missing headers
- Each one is an instruction the browser isn't getting. Most hosts and CDNs, including Cloudflare, let you add them without touching the site.
- Can be framed
- Without clickjacking protection, any site can load yours inside an invisible frame and trick visitors into clicking.
Understand the result
- Is your WordPress site a security risk? Plugins, PHP and what to check
Over half of WordPress sites run a plugin with a known vulnerability. The five things to check on yours, and what to do about each.
The other free checks: accessibility checker, wordpress vulnerability checker, php version checker and website speed test. Or run the full scan, which does all five at once.