Interpret the evidence

What a website security headers checker should tell you

A header's presence is evidence, not a complete security verdict. The value and the application context matter.

HTTP response headers can instruct browsers to prefer HTTPS, restrict script and resource sources, disable MIME sniffing, limit framing, control referrer information and constrain access to browser features. The right policy depends on the application: a static marketing page, authenticated dashboard, API response and embedded widget can legitimately need different settings.

Strict-Transport-Security

HSTS tells supporting browsers to use HTTPS for future requests to a host. It is only effective when delivered over HTTPS. Long durations, includeSubDomains and preload should be deployed deliberately because they have operational consequences.

Content-Security-Policy

CSP restricts the origins and execution patterns a page can use. A present CSP can still be overly broad, so this checker highlights obvious policy choices such as 'unsafe-eval', 'unsafe-inline' and wildcard script/default sources for review.

Framing protection

CSP frame-ancestors provides modern control over which parent pages may embed a document. X-Frame-Options remains useful for simpler or legacy framing restrictions.

MIME sniffing protection

X-Content-Type-Options: nosniff tells browsers to respect declared content types rather than trying to reinterpret them. Correct Content-Type values still matter.

Referrer-Policy

Referrer-Policy controls how much source URL information is sent with requests and navigations. A missing explicit policy is reported as informational rather than automatically called a vulnerability.

Permissions-Policy

Permissions-Policy can restrict access to browser capabilities such as camera, microphone and other features. Whether it is needed depends on what the application uses.

Why there is no fake security score

A numerical grade can imply precision the response headers do not provide. A strict CSP might break an application if copied blindly, while an apparently complete header set does not prove the server, authentication, application code or dependencies are secure. This tool reports concrete values, flags specific policy choices for review and explains what each result can and cannot establish.

Common security-header checks

HSTS missing on HTTPS

Confirm the site is fully HTTPS-ready before adding a long-lived policy. Test every subdomain before enabling includeSubDomains or preload.

CSP uses unsafe-inline

Review whether nonces, hashes or a narrower architecture can replace broad inline execution. Do not remove it blindly if the current application still depends on inline code.

No frame protection

If the page should not be embedded by arbitrary origins, define frame-ancestors in CSP and validate any legitimate iframe use cases.

Server technology disclosed

Server or framework headers are reported as informational. Removing unnecessary version disclosure can reduce fingerprinting, but hiding a header never replaces patching or secure configuration.