Security Header Check

Check a public website's HTTP security headers (HSTS, CSP, clickjacking, MIME sniffing, referrer and permissions policy) and whether http:// redirects to https://.

Result

Enter a public domain and click Check headers.

Note: Reads the response headers of the site's home page over HTTPS, following up to 3 redirects. The page body is never read. Only public addresses are checked. There is no letter grade: each header gets pass, warning or missing with the reason. Headers can differ by page, CDN edge or login state.