Security headers checker
Security headers are invisible instructions your server sends with every page — and they are the difference between a script injection being annoying and being catastrophic. Enter your domain and we fetch the homepage once and grade the three that matter: Content-Security-Policy, HSTS and X-Frame-Options.
Three headers, three verdicts, the exact values
Six findings, the same ones the £7.99 audit flags
This checker runs the security portion of our real audit engine — the rules behind the CSP, HSTS and clickjacking findings in every report we sell. One fetch, the verdicts below.
1 · No Content-Security-Policy
CSP is the browser-side backstop against cross-site scripting: it bounds what scripts, styles and connections a page may use. Without it, any script an attacker injects — through a comment field, a plugin, a widget — runs with full privileges. Flagged as an error, with a report-only rollout path in the fix.
2 · No HSTS (or a too-short max-age)
Strict-Transport-Security tells browsers to refuse plain HTTP for months at a time. Without it, the first request to http://yoursite can be intercepted and rewritten before your redirect to HTTPS ever happens. A max-age under ~180 days keeps that window open. Flagged as a warning.
3 · No X-Frame-Options
Without it any site can embed your pages in an invisible iframe and stack invisible buttons on top — clickjacking: the visitor thinks they are clicking the attacker's page but is clicking yours. Flagged as a warning; DENY or frame-ancestors 'none' closes it.
4 · CSP present but toothless
A policy whose only script rule is 'unsafe-inline' permits exactly the injection attacks CSP exists to stop. Present-but-protectless is flagged as a warning — the header exists, it just is not defending anything.
5 · ALLOW-FROM (the removed directive)
X-Frame-Options: ALLOW-FROM was never widely supported and has been deleted from modern browsers — the header is silently ignored and framing stays open. Flagged as a warning pointing at CSP frame-ancestors, the supported replacement.
6 · The second-tier headers
X-Content-Type-Options: nosniff (stops browsers re-guessing file types) and Referrer-Policy (stops full URLs leaking to other sites) are graded as informational notes — cheap one-liners, lower stakes than the big three.
What a hardened response looks like
Five headers, sent with every page response. This is the baseline the audit grades against — each line below is one deliberate decision.
- Line 1 bounds the blast radius. Only scripts from this site may run — an injected script tag simply does not execute.
- Line 2 locks in HTTPS. One year, subdomains included; browsers refuse plain HTTP before the first byte moves.
- Line 3 forbids framing. Nobody can invisibly embed your pages, which closes the clickjacking door.
- Lines 4–5 are the cheap one-liners. nosniff stops file-type guessing; the referrer policy stops full URLs (tokens included) leaking cross-site.
Security headers are 3 of 260+ checks
The checker above is free and instant. The full £7.99 audit runs all of it: 260+ checks across 21 categories on up to 25 pages, an AI-written plain-English report, delivered by email in ~30 minutes. What it costs · read a real sample report.
The full audit
Everything on this page plus the other 250+ checks, in one ordered fix-list.
- CSP, HSTS and X-Frame-Options graded on every audited page's responses
- The second tier: X-Content-Type-Options and Referrer-Policy
- TLS configuration and legacy protocol checks free scanners skip
- Certificate expiry and session-cookie flags
- Mixed-content and insecure-form detection, page by page
- Everything else: SEO, crawlability, accessibility, performance, AI-readiness
— Not ours to claim
What no external tool can do:
- See inside Search Console — crawl stats and indexing requests live behind your Google login; the report names the exact screen to open
- Edit your site for you — the fix is yours to apply (or ours: we do fixes too); the report gives the exact lines
- Promise rankings or AI citations — nobody honestly can; what the report guarantees is that nothing on your site mechanically blocks the machines that read it
Also honest: this checker looks at one slice. A passing slice with failing pages elsewhere is exactly what the full crawl is for.
Fair questions, straight answers
What is a Content-Security-Policy?
A response header that tells the browser what the page is allowed to load and connect to — which script sources, which styles, which endpoints. It is the strongest single defense against cross-site scripting, because an attacker's injected script simply does not execute unless the policy allows its origin. Getting it right is iterative: start in report-only mode, watch what breaks, tighten.
Is HSTS just another way of saying HTTPS?
No — HTTPS encrypts connections, HSTS makes browsers refuse to downgrade. Without the header, a visitor who types yourdomain.com or clicks an http:// link makes that first connection in plain HTTP, where a network attacker can redirect or read it before your redirect fires. HSTS closes that first-request window for months at a time.
Why would I block other sites from iframing me?
Because invisible framing is the mechanism of clickjacking: the attacker's page shows its own content but floats your page underneath, and the visitor's clicks land on your buttons — 'confirm payment', 'delete account' — thinking they are clicking something else. Unless you genuinely embed your app in partners' sites, DENY costs nothing and closes the hole.
Can a security header break my site?
Yes — a too-strict CSP is the classic way: it silently blocks your own analytics, fonts or inline scripts and parts of the page stop working. That is why the report's fix order starts with Content-Security-Policy-Report-Only, which logs violations without enforcing, so you tighten from evidence instead of guessing. HSTS has its own trap: includeSubDomains locks http://subdomains too, so only add it once every subdomain serves HTTPS.
Three headers, three verdicts. 257 more checks are waiting.
Enter your URL and pay securely — your report PDF lands in your inbox in ~30 minutes,
with CSP, HSTS, TLS config, cookies and 250+ other checks run and explained.