What is a Security Headers Checker?
Security headers are browser-level defenses your server can switch on with one line each: HSTS forces HTTPS, CSP blunts XSS, X-Frame-Options stops clickjacking. Most sites ship none of them.
This checker fetches your site once and scores the six headers browsers respect most, with a concrete fix for each one missing.
Frequently asked questions
Which header should I add first?
HSTS: one line, no side effects on an all-HTTPS site. CSP has the most impact but deploy it in report-only mode first.
Will adding these break my site?
HSTS, X-Content-Type-Options and Referrer-Policy are safe defaults. CSP and Permissions-Policy need testing against what your pages actually load.
Are missing headers a vulnerability?
Not by themselves: they are missing seatbelts, not crashes. Each one blocks a class of attack when something else goes wrong.
Where do I set these headers?
At your web server (nginx/Apache), CDN (Cloudflare), or framework middleware: whichever serves responses.