Free monitoring tool
Security Headers Checker
Inspect common HTTP security response headers without scanning for vulnerabilities or exploiting a website.
Headers are controls, not a security certificate
HSTS asks browsers to use HTTPS. Content-Security-Policy constrains permitted content. X-Content-Type-Options can prevent MIME sniffing. Referrer-Policy and Permissions-Policy control selected browser behavior. A present header can still be misconfigured.
Apply changes carefully
Review your application resources before enforcing CSP; a policy that blocks needed scripts can break a page. Test HSTS and subdomain coverage before setting a long duration. Evaluate framing rules against legitimate embedding requirements.
Scope of this check
The tool inspects a bounded HEAD response and shows a selected set of headers. It does not attempt exploitation, enumerate vulnerabilities or certify compliance. Redirects are not followed here; check the final canonical URL directly.
Common questions
Is a missing header always a vulnerability?
No. Applicability depends on the application and threat model. Investigate the control and intended behavior rather than adding headers blindly.
Can monitoring alert on a header value?
API monitors support an expected response-header value. Availability monitoring alone does not assess header policy quality.