Free Security Headers Checker
Enter a URL to check if it has the recommended HTTP security headers that protect your visitors from clickjacking, MIME sniffing, and protocol downgrade attacks.
What are security headers?
HTTP security headers are response headers your server sends to browsers to enforce security policies. Without them, your visitors are exposed to attacks like clickjacking (your site embedded in a malicious iframe), MIME sniffing (browsers executing files as a different type), and protocol downgrade attacks (HTTPS connections forced to plain HTTP).
What we check
- HSTS (Strict-Transport-Security) — forces HTTPS connections, preventing downgrade attacks
- X-Content-Type-Options — stops browsers guessing MIME types, preventing content injection
- X-Frame-Options — prevents your site from being embedded in iframes on other domains (clickjacking)
These three headers take under 10 minutes to add to any server config and protect every visitor. Most sites are missing at least one. For a full security and SEO audit across 26 checks, run a complete AuditZap audit.