Free tool
Website security headers
Check how a website protects its visitors: HTTPS, the security headers browsers act on, and how its cookies are set.
Run the check
What this checks
HTTPS and HSTS
We check that the page ends up on HTTPS, that plain http:// redirects there, and that Strict-Transport-Security tells browsers to use HTTPS every time.
Content-Security-Policy
Limits where scripts, styles and other resources can load from. It's the main defence against injected scripts, but allowing 'unsafe-inline' scripts removes most of that protection.
Framing, MIME sniffing and referrers
frame-ancestors (or X-Frame-Options) stops other sites embedding yours to trick clicks. X-Content-Type-Options: nosniff stops browsers guessing file types. Referrer-Policy controls how much of your address is shared with other sites.
Cookies
Cookies should be Secure on HTTPS sites, HttpOnly unless your scripts need them, and have a SameSite setting.
Nothing you enter is stored. Results come from public DNS and one request to the address you give.
Other free tools
Tell us what you're building.
Email us about your project: what it needs to do, who it's for and when you'd like it live.