Free check, instantly on screen

Security headers check: what does your web server tell the browser?

Six lines in your web server's response determine what a browser may do with your page. This check fetches your homepage (redirects within your own domain are followed, three at most) and reads those headers: HSTS, Content-Security-Policy, X-Content-Type-Options, X-Frame-Options, Referrer-Policy and Permissions-Policy, plus what the server gives away about itself.

Your own domain only: we check the main domain after the @ of your business e-mail address. The address itself is not stored and you will not receive any mail.

One check that only reads, at the moment you press the button. Address, domain and result are not kept.

What the check does

  • Which of the six security headers are present and whether the value is sound (HSTS max-age, unsafe-inline in CSP, nosniff).
  • Whether the server names its product and version, and whether cookies on the homepage carry the Secure, HttpOnly and SameSite flags.
  • Whether the homepage redirects, and where to; a redirect to http or to another domain is not followed.

What this check does not do

  • No letter grade like securityheaders.com; instead, per header, what is there and what the standard says.
  • Only the homepage; headers of login pages, APIs or subdomains are not tested.
  • An error page from a firewall or CDN is not judged as your homepage; the result says so.

Why only your own domain

The check runs on the main domain behind your business e-mail address. That is a threshold against looking up someone else's domain, in line with our acceptable use policy that you only check domains you own or are authorised to manage. The check only reads: a DNS lookup, a few connections, one page fetch, what a mail server or browser sees too.

What the result means

Security headers are instructions from your server to the browser: connect only over HTTPS on every next visit (HSTS), load scripts only from these sources (Content-Security-Policy), do not show this page in a frame on another site (X-Frame-Options), decide yourself how much of your URLs goes to third parties (Referrer-Policy). They are settings on your web server, although a working Content-Security-Policy does take work, and they make a whole class of attacks much harder, from cross-site scripting to clickjacking.

A missing header is rarely a leak in itself. It is a layer of defence that is missing. That is why the check marks HSTS and Content-Security-Policy as not in order and the other four as points of attention. A version number in the Server header gives an attacker a targeted search term: they then look for known vulnerabilities of exactly that version.

Headers are one part of what is visible from the outside. The whole picture, from DNS to open ports, is in what an attacker sees of your domain.

This is a single snapshot

A record that is correct today breaks at the next DNS migration; a certificate expires silently. The free security scan looks more broadly at what your domain exposes to the internet, and the knowledge base explains what a free check does and does not show.

Also check: mail records (SPF, DKIM, DMARC) · certificate and TLS

Further reading