Why does this need a server, unlike most tools here?

Reading another site's response headers from your browser is blocked by CORS, so this check is performed by Tool4U's own server, which fetches the URL and reports back which of the 6 headers it found. The URL isn't logged or stored.

Is a low score a serious problem?

It's a quick checklist, not a full security audit — a missing header is worth reviewing, but the right set depends on the site (an API has different needs than a page with user-generated HTML). Treat this as a starting point, not a verdict.

Which response is checked if the URL redirects?

The final response, after all redirects are followed.

Security Headers Checker

Check a URL for common HTTP security headers (HSTS, CSP, X-Frame-Options and more).

URL

The URL is fetched from our server (an arbitrary cross-origin fetch isn't possible directly from your browser) — the target site sees this server's request, not your IP, and nothing about the check is stored.

Related tools

How it works

1
Enter a URL
Including the protocol.
2
Checked against 6 common headers
HSTS, CSP, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy.
3
Get a score
Percentage present, with each header explained.

FAQ

Why does this need a server, unlike most tools here?: Reading another site's response headers from your browser is blocked by CORS, so this check is performed by Tool4U's own server, which fetches the URL and reports back which of the 6 headers it found. The URL isn't logged or stored.
Is a low score a serious problem?: It's a quick checklist, not a full security audit — a missing header is worth reviewing, but the right set depends on the site (an API has different needs than a page with user-generated HTML). Treat this as a starting point, not a verdict.
Which response is checked if the URL redirects?: The final response, after all redirects are followed.