IT infrastructure calculators

Security Header Check

Check the public home page for HSTS, CSP, clickjacking and other HTTP security headers, with a reason for each finding. A header alone does not prove a site secure.

Result

Enter a public domain and click Check headers.

Note: Reads the response headers of the site's home page over HTTPS, following up to 3 redirects. The page body is never read. Only public addresses are checked. There is no letter grade: each header gets pass, warning or missing with the reason. Headers can differ by page, CDN edge or login state.

Learn more

How it works

The tool reads the response headers of the site's home page over HTTPS, following up to 3 redirects. The page body is never read. Each check gets pass, warning or missing:

  • Strict-Transport-Security: pass needs max-age of at least 31536000 (1 year) and includeSubDomains.
  • Content-Security-Policy: warns if scripts are still exposed to 'unsafe-inline', 'unsafe-eval' or a wildcard source (*, https: or http:). 'unsafe-inline' is not flagged when the script policy also has a nonce or hash, because current browsers then ignore it; 'strict-dynamic' with a nonce or hash also makes wildcard sources ignored. 'unsafe-eval' is always flagged. A policy with no script-src or default-src gets a warning, because it does not limit scripts. The rules match the ones used in our 2026 security headers study.
  • X-Content-Type-Options: pass when set to nosniff.
  • Clickjacking protection: pass on CSP frame-ancestors, or X-Frame-Options DENY or SAMEORIGIN.
  • Referrer-Policy: warns on unsafe-url or no-referrer-when-downgrade.
  • Permissions-Policy and Cross-Origin-Opener-Policy: pass when present.
  • Version disclosure: warns if Server, X-Powered-By, X-AspNet-Version or X-AspNetMvc-Version show version numbers.
  • HTTP to HTTPS redirect: checks that http:// sends visitors to https://.
Worked example

Say a site sends Strict-Transport-Security: max-age=86400.

  • Result: warning, because 86400 seconds is 1 day, below the recommended 1 year
  • Changing it to max-age=31536000; includeSubDomains turns the check into a pass
  • Setting max-age=31536000 without includeSubDomains still gives a warning
Why is there no letter grade?

Each header gets pass, warning or missing with the reason instead, so you can see exactly what to change.

My CSP uses a nonce and strict-dynamic. Why does it still warn?

Since v1.27.6 the check no longer flags 'unsafe-inline' when your script policy has a nonce or hash: modern browsers ignore it then, and it only serves as a fallback for old browsers. If it still warns, look at the reason: 'unsafe-eval' is not cancelled by a nonce or 'strict-dynamic', so it is always flagged.

Why does another scanner show something different?

Only the home page is checked. Headers can differ by page, CDN location or login state.

Do I need X-Frame-Options if I set frame-ancestors?

This check passes on either one. frame-ancestors in CSP is the newer control; X-Frame-Options covers older browsers.

Maintained by the RACKCRUNCH team. Last reviewed September 29, 2026. How we calculate | Report a problem