Is a low score a serious problem?

It's a quick checklist, not a full security audit — a missing header is worth reviewing, but the right set depends on the site (an API has different needs than a page with user-generated HTML). Treat this as a starting point, not a verdict.

Which response is checked if the URL redirects?

The final response, after all redirects are followed.

Security Headers Checker

Check a URL for common HTTP security headers (HSTS, CSP, X-Frame-Options and more).

URL

The URL is fetched from our server (an arbitrary cross-origin fetch isn't possible directly from your browser) — the target site sees this server's request, not your IP, and nothing about the check is stored.

Related tools

HTTP Status Checker
Redirect Chain Viewer
URL Expander
HTTP Headers Checker

How it works

1
Enter a URL

Including the protocol.
2
Checked against 6 common headers

HSTS, CSP, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy.
3
Get a score

Percentage present, with each header explained.

FAQ

Is a low score a serious problem?: It's a quick checklist, not a full security audit — a missing header is worth reviewing, but the right set depends on the site (an API has different needs than a page with user-generated HTML). Treat this as a starting point, not a verdict.
Which response is checked if the URL redirects?: The final response, after all redirects are followed.