Website Security Header Checker

All pages must be served over HTTPS. HTTP-only pages expose visitor data in transit.

HSTS instructs browsers to only use HTTPS. Without it, users are vulnerable to protocol downgrade attacks.

Prevents MIME-type sniffing attacks. Should be set to "nosniff" on all responses.

The most powerful XSS mitigation header. Controls which resources browsers are allowed to load.

Prevents your site from being embedded in iframes — blocking clickjacking attacks.

Controls how much URL information is sent when visitors navigate away. Prevents sensitive URL leakage.

Open directory indexes expose your file structure to anyone. We check for this common misconfiguration.