HTTP security headers checker
HSTS, Content-Security-Policy, X-Frame-Options, nosniff, Referrer-Policy: check for free the protections your site sends to browsers.
Passive scan: we only read public information (DNS, home page, certificate). No port scanning, no intrusion attempts. Active testing requires written authorization (Criminal Code, s. 342.1).
Recommended values
A good starting point for most small-business sites. Adapt the CSP to the scripts you actually use.
| Header | Value | Purpose |
|---|---|---|
| Strict-Transport-Security | max-age=31536000; includeSubDomains | Forces HTTPS in the browser. |
| Content-Security-Policy | default-src 'self'; frame-ancestors 'none' | Limits allowed scripts (XSS). |
| X-Frame-Options | DENY | Prevents framing (clickjacking). |
| X-Content-Type-Options | nosniff | Stops browsers guessing file types. |
| Referrer-Policy | strict-origin-when-cross-origin | Avoids leaking internal URLs. |
| Permissions-Policy | camera=(), microphone=(), geolocation=() | Disables unneeded features. |
What next?
Headers protect against common attacks but don’t replace testing your application: access control, sessions, injection. That is what a web penetration test covers.
Frequently asked questions
What is an HTTP security header?+
An instruction your server sends the browser with every page, such as “always use HTTPS” or “only run my site’s scripts”. They reduce the impact of many attacks without changing the site.
Where do I add these headers?+
In your web server, CDN (Cloudflare, etc.) or hosting configuration. On WordPress, a plugin or your host’s settings is often enough.
Can a CSP break my site?+
Yes, if it is too strict at first. Start in Content-Security-Policy-Report-Only mode to observe, then enforce it.