What this checks
- Content-Security-Policy
- Strict-Transport-Security
- X-Content-Type-Options
- Referrer-Policy
Headers · security headers checker
Security headers checker
Check whether a public URL is missing common security headers such as CSP, HSTS, X-Content-Type-Options and Referrer-Policy.
Ask Richard about your report
Paid reports include direct founder help. If a finding is unclear, send it with the page, evidence and suggested fix attached, and Richard will explain what to do next.
Security headers first pass
Checks common browser security headers returned by the public URL.Public pages only. No account, no card, no worker job.
Why it matters
- Headers reduce browser-side attack surface.
- AI-built apps often ship framework defaults without a CSP.
- Missing headers are easy to fix once they are visible.
How to use it
Use the checker above for a deterministic header check. The full scan adds context, severity and route-by-route evidence.
Run complete launch scanExample result
What a free headers check can surface.
Review before launch
Content-Security-Policy
The free tool gives you a visible first-pass signal. A paid PageLens AI report adds page evidence, severity, screenshots, ownership context and a scoped repair prompt.
What the full scan adds
- Desktop and mobile screenshots for every priority finding.
- Severity, owner impact and fix acceptance criteria.
- Markdown repair prompts for Cursor, Codex, Lovable, Bolt and other builders.
- Re-scan proof when the page improves.
Copy-paste fix prompt
Review this page for security headers checker. Start with this finding: "Content-Security-Policy". Make the smallest production-safe fix, preserve the existing design, then list verification steps for desktop, mobile and crawler-visible HTML.
Upgrade path
Free Growth Baseline
$0
First visible signal
Full One-Page
$1
Every finding on one page
Launch Pack
$29
15 pages plus re-scan proof
Target keyword: security headers checker
Why security headers are a high-signal launch check
A security headers checker reviews the browser-level protections your server sends with each public page. These headers do not make an insecure application secure by themselves, but they reduce common attack paths and show that the site has moved beyond framework defaults. For startups, agencies and AI-built sites, missing headers are often one of the quickest trust wins.
Good security header posture starts with HTTPS and HSTS so browsers know to use secure connections. X-Content-Type-Options helps prevent MIME sniffing. Referrer-Policy limits the data leaked when users click away. A careful Content-Security-Policy can reduce the blast radius of cross-site scripting, though it needs testing so it does not break legitimate scripts.
This free check is useful before launch, procurement reviews, app store submissions and customer security questionnaires. It gives you a concrete list of response headers to add or tune, then a full audit can connect those findings to cookies, third-party scripts and page-specific evidence.
Frequently asked.
- What is a security headers checker?
- It fetches a public URL and reviews the HTTP response headers browsers use for protections such as HTTPS enforcement, content security policy, MIME sniffing and referrer leakage.
- Which security header matters most?
- There is no single universal answer, but HSTS, Content-Security-Policy, X-Content-Type-Options and Referrer-Policy are high-value basics for most public websites.
- Will adding headers break my site?
- Some headers, especially Content-Security-Policy, can break scripts if configured too tightly. Add them deliberately, test production-like pages and loosen only the sources you actually need.
- Do security headers improve SEO?
- They are not a ranking shortcut, but secure, trustworthy pages reduce risk and support the broader quality signals search engines and customers expect.