What this checks
- Content-Security-Policy
- Strict-Transport-Security
- X-Content-Type-Options
- Referrer-Policy
Headers · security headers checker
Security headers checker
A security headers checker inspects the HTTP response headers a public page returns, including protections that reduce framing, content-type and browser policy risks. Enter a URL to see which signals are present or missing and what to review next. Results describe header posture; they are not a penetration test or security guarantee.
Ask Richard about your report
Paid reports include direct founder help. If a finding is unclear, send it with the page, evidence and suggested fix attached, and Richard will explain what to do next.
Security headers first pass
Checks common browser security headers returned by the public URL.Public HTML only. No account or card. This does not render the page.
Want to check more of this page's basics?Try the free website check
Why it matters
- Headers reduce browser-side attack surface.
- AI-built apps often ship framework defaults without a CSP.
- Missing headers are easy to fix once they are visible.
How to use it
Use the checker above for a deterministic header check. The full scan adds context, severity and route-by-route evidence.
Get Website Review · $9
Choose your website after sign-in. Nothing is charged on this page.
Example result
What a free headers check can surface.
Review before launch
Content-Security-Policy
The free tool gives you a visible first-pass signal. A paid PageLens AI report adds page evidence, severity, screenshots, ownership context and a scoped repair prompt.
What the Website Review adds
- Browser-based checks across up to 15 public pages on desktop and mobile.
- Captured screenshots and evidence-linked improvement priorities.
- Markdown repair prompts for Cursor, Codex, Lovable, Bolt and other builders.
- One verification re-scan to check your changes. Not proof of conversion lift.
Illustrative fix prompt
Review this page for security headers checker. Start with this finding: "Content-Security-Policy". Make the smallest production-safe fix, preserve the existing design, then list verification steps for desktop, mobile and crawler-visible HTML.
Choose a broader review
Free website check
$0
One public page's HTML and headers, up to three findings and a practical next step
Website Review
$9
Up to 15 public pages, desktop/mobile evidence, fix instructions and one re-scan
Get Website Review · $9
Choose your website after sign-in. Nothing is charged on this page.
One-time USD payment. Account required. No subscription.
What the result means
Use the checker above for a deterministic header check. The full scan adds context, severity and route-by-route evidence.
Limits of this check
Headers are one layer of web security. This check does not test application logic, dependencies, authentication, infrastructure, exploitability or whether a policy is correctly tuned for every route.
Why security headers are a high-signal launch check
A security headers checker reviews the browser-level protections your server sends with each public page. These headers do not make an insecure application secure by themselves, but they reduce common attack paths and show that the site has moved beyond framework defaults. For startups, agencies and AI-built sites, missing headers are often one of the quickest trust wins.
Good security header posture starts with HTTPS and HSTS so browsers know to use secure connections. X-Content-Type-Options helps prevent MIME sniffing. Referrer-Policy limits the data leaked when users click away. A careful Content-Security-Policy can reduce the blast radius of cross-site scripting, though it needs testing so it does not break legitimate scripts.
This free check is useful before launch, procurement reviews, app store submissions and customer security questionnaires. It gives you a concrete list of response headers to add or tune, then a full audit can connect those findings to cookies, third-party scripts and page-specific evidence.
Frequently asked.
- What is a security headers checker?
- It fetches a public URL and reviews the HTTP response headers browsers use for protections such as HTTPS enforcement, content security policy, MIME sniffing and referrer leakage.
- Which security header matters most?
- There is no single universal answer, but HSTS, Content-Security-Policy, X-Content-Type-Options and Referrer-Policy are high-value basics for most public websites.
- Will adding headers break my site?
- Some headers, especially Content-Security-Policy, can break scripts if configured too tightly. Add them deliberately, test production-like pages and loosen only the sources you actually need.
- Do security headers improve SEO?
- They are not a ranking shortcut, but secure, trustworthy pages reduce risk and support the broader quality signals search engines and customers expect.