Security Tools

Security Headers Checker

Scan a website's HTTP response for recommended security headers and get a score out of 100.

Enter a domain to scan its security headers and get a score out of 100.

More Security Tools

Mixed Content Detector HTTPS Redirect Checker CORS Header Checker HSTS Checker Permissions-Policy Checker Content Security Policy (CSP) Checker Referrer-Policy Checker X-Frame-Options Checker

JustChecker monitors your security headers continuously and alerts you if anything regresses.

What Is the Security Headers Checker?

Security headers tell browsers how to protect visitors - for example to always use HTTPS or refuse to load the page in a frame. This tool fetches a website, checks for the recommended headers (such as HSTS, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy and Permissions-Policy) and gives a score out of 100.

When to Use It

During a security review or before a penetration test.
After changing web server, CDN or framework configuration.

How to Use It

Enter the domain.
Review present and missing headers and the recommendations.

Understanding the Result

Missing headers lower the score. Add them in your web server configuration (Nginx add_header, Apache Header set), your framework's middleware or your CDN's settings.

Limitations

The check confirms headers are present, not that every value is ideal - a Content-Security-Policy with unsafe-inline is weaker than a strict one. Each header also has its own dedicated checker in this category.

Frequently Asked Questions

It combines the presence and correct configuration of every major browser-security-relevant header (HSTS, CSP, X-Frame-Options, and others) into a single number - a higher score means more of the recommended protections are actually in place.

Security headers are defensive measures against attacks that don't break normal functionality (clickjacking, cross-site scripting, MIME-sniffing) - a site can appear to "work fine" while still being exposed to attacks these headers specifically prevent.

HSTS (forcing HTTPS) and a basic Content-Security-Policy tend to provide the broadest protection for the effort involved - though the ideal priority depends on your specific site's risk profile.

A misconfigured Content-Security-Policy in particular can block legitimate scripts/styles from loading if not carefully scoped - test changes on a staging environment first, and expect CSP to need iteration rather than a single perfect configuration.

Most are set via web server configuration (Nginx, Apache), a reverse proxy/CDN, or application-level middleware - none of them are DNS records or anything configured through your domain registrar.

No - these headers address a specific category of browser-enforced protections; overall security also depends on server hardening, application code, dependency management, and many factors this specific check doesn't evaluate.