Check Your Website's Security Headers (Free Tool + curl)

Security headers are short instructions your web server sends with every page that tell the browser how to protect your visitors. Check which ones your site sends in 10 seconds, with one curl command or our free tool.

1. See every header your site sends

On Mac, Linux or Windows Terminal, curl -sI fetches only the response headers. Replace example.com with your own site.

curl -sI https://example.com

2. Look for HSTS first

Strict-Transport-Security tells browsers to always use HTTPS for your site. If this command prints nothing, the header is missing.

curl -sI https://example.com | grep -i strict-transport-security

3. The headers to look for

Strict-Transport-Security forces HTTPS. Content-Security-Policy limits which scripts and files can load. X-Frame-Options (or CSP frame-ancestors) stops other sites from framing yours. X-Content-Type-Options: nosniff stops file-type guessing. Referrer-Policy controls what your URLs leak to other sites. Permissions-Policy turns off features like the camera or microphone that your site does not use.

Strict-Transport-Security
Content-Security-Policy
X-Frame-Options
X-Content-Type-Options
Referrer-Policy
Permissions-Policy

4. Add what is missing

Add headers in your web server config, then test again. Start Content-Security-Policy in report-only mode so it cannot break your site while you tune it.

# nginx example
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;

Free tool: Headers & Inspector

Paste your address into the free Headers & Inspector tool and it lists every security header your site sends and which ones are missing. No signup. Open the free Headers & Inspector

FAQ

Which security header matters most?

Strict-Transport-Security (HSTS) and Content-Security-Policy give the most protection. HSTS is easy to add; CSP takes testing, so start it in report-only mode.

Is X-XSS-Protection still needed?

No. Modern browsers ignore it, and the current advice is to rely on Content-Security-Policy instead.