Free check, takes a few seconds
Does your website send the basic security headers?
Type your domain. We read what the site sends to every visitor and tell you in plain words what is missing and what to add.
What happens to your data. The domain you type is sent to our check service, which reads the public site once and returns the result. We do not store the domain, the result or your address. We keep only an anonymous daily count of how many checks ran. We set no cookies for this. The check reads only what any visitor can see.
What this checks
Security headers are short instructions your website sends along with every page. They tell the browser to use https only, to refuse being embedded in other sites, to limit which scripts may run, and to share less information about your visitors. Adding them costs little and closes common weaknesses.
The check opens your home page once, from our server, the way any visitor's browser would, and reads the response headers. It does not log in, submit forms, scan other pages or test for vulnerabilities.
Limits, stated plainly
- This reads the home page only. Other pages, subdomains and the admin area can behave differently.
- A site can have every header and still have other weaknesses. Having the headers is a good basic hygiene step, not a security guarantee.
- We promise no result and give no compliance verdict. This is not a penetration test and not legal advice.
- If the check cannot complete, it says so. We never treat an error as "no problem".
Want help fixing what the check found? Write to us on the contact page, in writing, and describe the site. You do not need to buy anything: the check stays free.