--- title: "Free Security Header Checker — HSTS, CSP and More" description: "Free security header scanner. Check HTTP security headers like HSTS, CSP, X-Frame-Options. Get an A+ to F grade with fix instructions." canonical: "https://lemwatch.com/tools/security-header-checker" source: "https://lemwatch.com" --- # security header checker > Scan your website's HTTP security headers and get a grade from A+ to F. Find missing headers and get configuration examples. Security headers are instructions your server sends with every response telling the browser what it is allowed to do with your page. They cost nothing, they are configured once, and they close whole classes of attack. Enter a URL above and the check reads the live response headers and reports which protections are present, which are missing, and which are set to values that look right but do nothing. ## The headers that matter, in the order they matter Strict-Transport-Security tells the browser to refuse to load your site over plain HTTP ever again, which stops the downgrade attack that a redirect alone leaves open. Content-Security-Policy declares which sources may execute scripts, which is the single strongest defence against cross-site scripting — and the hardest to get right. X-Frame-Options (or the equivalent CSP frame-ancestors directive) stops your pages being embedded in someone else's site to trick your users into clicking things they cannot see. X-Content-Type-Options stops the browser guessing that an uploaded text file is really JavaScript. Referrer-Policy controls how much of your URL leaks to third parties. Permissions-Policy turns off camera, microphone and geolocation access for code you did not write. ## Why headers disappear Header configuration lives in the layer nobody owns: an nginx include, a CDN rule, a framework middleware, a hosting control panel toggle. Each deploy, migration or CDN change can drop them silently. The site works, the tests pass, and the protection is gone. This is why a header check taken once is worth much less than the same check repeated — most teams do not lose their headers in one dramatic moment, they lose them in a Tuesday afternoon configuration change. ## Reading a poor grade A missing header is not automatically an emergency. The realistic order of work is: get HSTS on, because it is one line and it closes a real attack; set X-Content-Type-Options and X-Frame-Options, because they are one line each and break almost nothing; set a Referrer-Policy; then take Content-Security-Policy seriously as a project rather than a quick fix. A policy containing unsafe-inline and a wildcard source scores as present and protects against very little, which is why the check reports what the value actually allows rather than just whether the header exists. ## After the first fix The value of headers is that they stay set. Once your grade is where you want it, the thing worth watching is regression — the deploy that drops the CSP, the CDN change that strips HSTS. That is a continuous check, not a one-off audit. ## What this tool checks - Strict-Transport-Security (HSTS) - Content-Security-Policy (CSP) - X-Frame-Options - X-Content-Type-Options - Referrer-Policy - Permissions-Policy ## Why it matters Security headers protect your site and visitors from attacks like clickjacking, XSS, and data injection. Missing headers leave your site vulnerable and can lower your security rating. ## How to fix what it finds - Add HSTS header to enforce HTTPS - Implement Content-Security-Policy to prevent XSS - Set X-Frame-Options to prevent clickjacking - Add X-Content-Type-Options: nosniff ## Methodology We issue a single HTTPS GET to the URL you enter, following up to five redirects, and read the response headers of the final response — the one a browser would actually apply. Each header is parsed rather than merely detected: Strict-Transport-Security is checked for a max-age long enough to be meaningful and for includeSubDomains, Content-Security-Policy is inspected for directives that neutralise it such as unsafe-inline, unsafe-eval and wildcard sources, X-Frame-Options is checked for DENY or SAMEORIGIN and cross-referenced against a CSP frame-ancestors directive that supersedes it, and Referrer-Policy and Permissions-Policy are checked against the values browsers currently honour. Headers set on a redirect hop but not on the final response are reported as missing, because that is how the browser treats them. The grade is a weighted deduction from 100, with more weight on HSTS and Content-Security-Policy than on the advisory headers. We read only headers — no page content is executed, and nothing is stored beyond the result you see. ## This tool also answers ### How do I check HTTP headers online? Enter any URL above. The checker performs a live request and returns every HTTP response header the server sent, including status line, redirects, caching, content-type and the full security header set — no extension or terminal needed. ### Is there an HTTP response header checker? Yes. This tool is a full HTTP response header checker: it shows raw response headers exactly as returned, then grades the security-relevant ones (HSTS, CSP, X-Frame-Options, Referrer-Policy, Permissions-Policy) with fixes for anything missing. ## Frequently asked questions ### Which security header should I add first? Strict-Transport-Security. It is one line, it breaks nothing on a site already serving HTTPS everywhere, and it closes the protocol-downgrade attack that a plain HTTP-to-HTTPS redirect leaves wide open. ### My CSP is present but the grade is still low. Why? A Content-Security-Policy containing unsafe-inline, unsafe-eval or a wildcard script source permits nearly everything it is supposed to block. The header exists; the protection does not. The check grades what the policy allows, not whether the header is set. ### Will these headers break my site? X-Content-Type-Options, X-Frame-Options and Referrer-Policy are safe to add on almost any site. Content-Security-Policy can break third-party scripts and inline handlers, so roll it out in report-only mode first, read the reports, then enforce. ### Do security headers affect SEO? Not directly as a ranking factor. Indirectly they matter: a site that gets compromised and serves injected spam loses rankings quickly, and mixed-content and framing problems damage user trust signals. ### Should headers be set at the CDN or the application? Either works, but pick one and document it. The common failure is setting them in both places with different values, where whichever layer runs last silently wins and nobody knows which that is. ### How often should I re-check? After every infrastructure or CDN change at minimum. Headers are lost in configuration changes far more often than they are deliberately removed, which is the argument for checking them on a schedule rather than by hand. ### How do I check HTTP headers online? Enter any URL above. The checker performs a live request and returns every HTTP response header the server sent, including status line, redirects, caching, content-type and the full security header set — no extension or terminal needed. ### Is there an HTTP response header checker? Yes. This tool is a full HTTP response header checker: it shows raw response headers exactly as returned, then grades the security-relevant ones (HSTS, CSP, X-Frame-Options, Referrer-Policy, Permissions-Policy) with fixes for anything missing. ## Lemwatch at a glance - What it is: website monitoring that checks uptime, page changes, SEO, security, SSL and speed in one tool. - Free plan: 10 sites, no time limit, all check types. - Pro: $19/mo, 50 sites, public API and webhooks. - Agency: $59/mo, 150 sites, white-label status pages. - Source: https://lemwatch.com/pricing (facts verified from the product's own plan limits). ## Related - [All free tools](https://lemwatch.com/tools) - [SSL checker](https://lemwatch.com/tools/ssl-checker) - [mixed content checker](https://lemwatch.com/tools/mixed-content-checker) - [DNS lookup](https://lemwatch.com/tools/dns-lookup) - [meta tag analyzer](https://lemwatch.com/tools/meta-tag-analyzer) - [Lemwatch pricing](https://lemwatch.com/pricing) - [All monitoring checks](https://lemwatch.com/features) - [Sitemap Checker](https://lemwatch.com/tools/sitemap-checker)