Enter a URL to check its HTTP security headers.

HTTP Security Headers

Analyze security headers (HSTS, CSP, X-Frame-Options, etc.) for any URL using a public CORS proxy. Grades and recommendations included.

Common uses

  • Check which security headers a site is missing
  • Verify that HSTS is enabled on a domain

Also searched as

  • check http security headers online
  • security headers scanner
  • check hsts header
  • missing security headers
  • x-frame-options check
  • analyze http response headers
  • paste response headers security grade
  • permissions-policy builder
  • securityheaders.com alternative
  • clickjacking protection header check

Frequently asked questions

Is my data uploaded to a server?

Partially — see the note above. In "Fetch URL" mode, the URL you enter is relayed through public CORS proxies to read its response headers. Switch to "Paste Headers" mode to keep everything local.

How do I check which security headers a site is missing?

Enter a URL in the Fetch URL tab to analyze headers like HSTS, CSP and X-Frame-Options and get a grade and recommendations.

Can I check headers without fetching a URL?

Yes, the Paste Headers tab analyzes response headers you paste in.

Can I build a Permissions-Policy header?

Yes, the Build Permissions-Policy tab lets you set each feature to none, self or all and copy the header, and it also builds a Referrer-Policy header.

Why does fetching a URL go through a proxy?

Browsers cannot read another site's response headers directly, so the request is made by this site's own backend rather than your browser. Pasting headers avoids that step.