What this security headers checker checks
- Strict-Transport-Security (HSTS)
- Content-Security-Policy (CSP)
- X-Content-Type-Options and Referrer-Policy
- Permissions-Policy and Cross-Origin-Opener-Policy
How to read the result
Header presence is a starting point, not proof of a secure configuration. A weak CSP can exist while technically present, and the appropriate policy depends on what the site loads and how it works.
How to use it
- Enter the complete public HTTPS URL you want to inspect.
- Select the check button and wait for the live response.
- Review the result and correct any issue at the website or hosting provider.
- Run the checker again to confirm the public response changed.
Common questions
Is a 100% score a security certification?
No. It only means all six checked headers were present. It does not test their strength or find application vulnerabilities.
Can adding headers break a website?
Yes. CSP, COOP, and Permissions-Policy can block required resources or browser features when configured incorrectly.
Why is HSTS important?
It tells supported browsers to use HTTPS for future visits, which reduces exposure to protocol-downgrade attacks.