Security Headers: Inspect HTTP Policies and Scan Limits
Inspect real HTTP response headers and understand CSP and HSTS. The current FindUtils analyzer displays a demonstration grade, so verify the response separately.
Enter a website URL to check its security headers
Why Security Headers Matter
Security headers provide an additional layer of protection against common web vulnerabilities.
Prevent cross-site scripting (XSS) attacks
Block clickjacking and UI redressing
Force secure HTTPS connections
Control browser feature access
How to Analyze Security Headers
-
Enter the target URL
Type or paste the full URL of the website you want to analyze into the input field. Include the protocol (https://) for accurate results. The tool accepts any publicly accessible web address. -
Run the analysis
Click the Analyze Headers button to start the scan. The tool sends a request to the target URL and inspects every HTTP response header returned by the server, checking for the presence and correct configuration of security-critical headers. -
Review the security score and grade
After the scan completes, review the overall security score and letter grade. Each header is listed with a pass or fail status. Missing headers are flagged with specific recommendations explaining what attack they prevent and how to implement them. -
Fix missing headers and re-test
Use the recommendations to add or correct headers in your web server, application code, or CDN configuration. After deploying changes, return to the analyzer and run a fresh scan to confirm all headers are properly configured.
Guides and articles
Read instructions and examples for this tool.
SSL Certificate Checker: Verify HTTPS & Expiry Online
Verify any website's SSL certificate in seconds with our free SSL Certificate Checker. Check expiry dates, the certificate chain, the issuing authority, and common HTTPS misconfigurations.
Bot Crawl Checker: Test HTTP Access and Robots Rules
Check crawler access with FindUtils and HTTP requests. Separate robots.txt rules, noindex, blocked responses, and verified crawler access.
Why Search Engines and AI Bots Cannot Read Your Website
A working browser page does not prove crawler access. Use this diagnostic sequence to check responses and indexing controls without weakening security.
Load Balancer Design: Nginx, HAProxy, and Caddy Configs
Learn how to visually design load balancer architectures with drag-and-drop components, validate your design for single points of failure, and export starter configuration files for Nginx, HAProxy, Caddy, Docker Compose, and Terraform.
Who Uses Security Headers Analysis
Web Developers and DevOps Engineers
Developers use security header analysis during deployment pipelines to verify that server configurations include all recommended headers. A quick scan after each release catches misconfigurations before they reach production users.
Security Auditors and Penetration Testers
Security professionals include header analysis as part of web application assessments. Missing or misconfigured headers such as CSP, HSTS, and X-Frame-Options are commonly flagged findings in penetration test reports.
Site Owners and IT Managers
Non-technical stakeholders use header analyzers to get a quick health check of their website security posture. The letter grade and pass/fail format provides an easy-to-understand overview without requiring deep technical knowledge.
SEO and Compliance Teams
Teams responsible for search rankings and regulatory compliance check security headers to ensure HTTPS enforcement (HSTS) and data protection policies are active. HTTPS is a confirmed Google ranking factor, and headers like Referrer-Policy help control data leakage.
Why Check Security Headers?
Security headers are your first line of defense against common web attacks. They protect against XSS, clickjacking, MIME sniffing, and other vulnerabilities.
HTTP security headers are directives sent by a web server in every response that instruct the browser how to handle page content. When properly configured, they block entire categories of attacks including cross-site scripting, clickjacking, protocol downgrade, and data injection. The Security Headers Analyzer scans any public URL and evaluates its headers against current best practices, producing a score, a letter grade, and actionable recommendations for every missing or misconfigured header.
The analyzer checks for ten critical headers: Content-Security-Policy, Strict-Transport-Security, X-Frame-Options, X-Content-Type-Options, X-XSS-Protection, Referrer-Policy, Permissions-Policy, Cross-Origin-Opener-Policy, Cross-Origin-Embedder-Policy, and Cross-Origin-Resource-Policy. Each header targets a specific threat vector. For example, CSP prevents unauthorized script execution, HSTS forces encrypted connections, and Permissions-Policy restricts access to browser APIs like camera and geolocation. Together they form a layered defense that complements application-level security.
Security header analysis pairs naturally with other checks in a complete website audit. Use the SSL Certificate Checker to verify your TLS configuration, the DNS Security Scanner to inspect DNSSEC and DNS records, and the Cookie Analyzer to confirm cookies use Secure and HttpOnly flags. For broader threat detection, the URL Safety Checker screens URLs against known malware and phishing databases. Running all of these tools together gives a comprehensive view of your site's security posture.
How it compares
Dedicated security header scanners like SecurityHeaders.com and Mozilla Observatory offer server-side analysis that can read all response headers without browser CORS restrictions. These services are useful for deep audits but often require navigating external sites and may rate-limit usage. The FindUtils Security Headers Analyzer provides instant in-browser analysis with a clean pass/fail breakdown and specific fix recommendations, making it ideal for quick checks during development or deployment. For the most thorough audit, combine this analyzer with a server-side scanner and manual review of your web server or CDN configuration.
Browser developer tools (the Network tab in Chrome or Firefox) also display response headers, but they require manually inspecting each header and knowing what values are correct. The analyzer automates this by grading each header against security best practices and highlighting exactly what is missing, saving significant time compared to manual inspection.
Security Headers Best Practices
- Start with Content-Security-Policy in report-only mode to log violations before enforcing rules, preventing accidental breakage of scripts or styles on your site.
- Set Strict-Transport-Security with a max-age of at least one year (31536000 seconds) and include the includeSubDomains and preload directives for full HSTS coverage.
- Always pair X-Content-Type-Options: nosniff with correct Content-Type headers on all responses to prevent browsers from guessing MIME types incorrectly.
- Use Permissions-Policy to explicitly disable browser features you do not use, such as camera, microphone, and geolocation, reducing your attack surface.
- Combine X-Frame-Options with CSP frame-ancestors for backward compatibility. Modern browsers respect frame-ancestors, while older browsers fall back to X-Frame-Options.
Frequently Asked Questions
What are HTTP security headers?
Security headers are HTTP response headers that instruct browsers how to handle your website's content, protecting against various attack vectors.
Which headers are most important?
Content-Security-Policy and Strict-Transport-Security are crucial. X-Frame-Options, X-Content-Type-Options, and Referrer-Policy are also highly recommended.
Will adding headers break my site?
Some headers like CSP need careful configuration. Start with report-only mode to identify issues before enforcing policies.
How do I add security headers?
Headers can be added via web server configuration (Apache, Nginx), application code, or CDN settings depending on your setup.
What is Content-Security-Policy and why is it critical?
Content-Security-Policy (CSP) is an HTTP header that controls which resources a browser is allowed to load on a page. It is the most effective defense against cross-site scripting (XSS) attacks because it restricts inline scripts, unauthorized script sources, and unsafe eval calls.
What does Strict-Transport-Security (HSTS) do?
HSTS tells browsers to only connect to your site over HTTPS, even if a user types http:// in the address bar. It prevents protocol downgrade attacks and cookie hijacking. A recommended value is max-age=31536000 with includeSubDomains and preload directives.
How often should I check my security headers?
You should scan your headers after every deployment, server configuration change, or CDN update. Automated weekly scans are recommended as part of a continuous security monitoring process. Header configurations can silently change when infrastructure is updated.
Do security headers affect SEO or site performance?
Security headers have no negative impact on page load speed. In fact, Google considers HTTPS (enforced by HSTS) a ranking signal. Properly configured headers signal a trustworthy site to both search engines and visitors.
What is the difference between X-Frame-Options and CSP frame-ancestors?
Both prevent clickjacking by controlling whether a page can be embedded in an iframe. X-Frame-Options is the older header with limited options (DENY, SAMEORIGIN). CSP frame-ancestors is more flexible, supports multiple origins, and is the recommended modern replacement.
Can I test security headers without deploying to production?
Yes. You can test headers on staging or development environments. Many web servers and CDNs let you add headers to specific environments. Use report-only mode for Content-Security-Policy to log violations without blocking resources during testing.