Skip to content
frabs.
All tools

/security-headers

Security Headers

Check for HSTS, CSP, X-Frame-Options and other security headers.

Try:

About Security Headers

Security Headers checks a website's response for the specific headers browsers rely on to enforce protections like forced HTTPS, restricted script sources and clickjacking prevention, reporting which are present and which are missing.

Each header is scored individually with an explanation of what it actually protects against, rather than folded into a single pass or fail result, since a site can be missing one header while every other protection is correctly configured.

Run this after a server configuration change, as part of a routine security review, or whenever you want a plain answer to what specific protections a site's headers are and are not currently providing.

Tutorials

Reading an SSL Certificate, Field by FieldWhat the common name, issuer, validity dates and chain of trust in a certificate actually mean, and how to read them in an SSL Checker result.7 min readWhy Your SSL Certificate Might Show as InvalidThe five most common reasons a certificate fails validation, and a sensible order to check them in rather than guessing.6 min readHTTPS and TLS, What the Padlock Is Actually Telling YouWhat encryption in transit protects against, what it does not, and why a valid certificate and a security header check both matter.6 min readContent Security Policy ExplainedWhat a CSP header actually restricts, why it matters even on a site with no obvious vulnerabilities, and how to read one without getting lost in the syntax.6 min readHSTS Explained: What It Protects and What It Does NotWhy telling a browser to always use HTTPS closes a gap a valid certificate alone leaves open, and what to check before turning it on.5 min read

Related Tools