Free headers check · no email needed
Free security headers checker
Paste your web address. We'll read the headers your server sends, give you a grade, and hand you the exact line to add for anything that's missing. Takes a few seconds.
One normal request to your homepage, same as a browser. Nothing to install, no email. Also try the SPF and DMARC checker or page check.
How do I check my website's security headers?
Paste your web address into the checker at the top of this page. We make one normal request to your homepage, read the response headers and grade six of them: HSTS, CSP and four quicker ones we explain further down. Each missing one comes with the exact line to add. No sign-up, no email.
What we grade
Six headers, mostly one line each.
HSTS and CSP carry the most weight. The other four are quick wins you can add in a coffee break.
HTTPS, always
Tells browsers never to load your site over plain http://. Use max-age=31536000, which is a year.
Who may run scripts
Lists where scripts, styles and frames can come from. The trickiest one, so test it in report-only mode first.
nosniff, framing, referrer, permissions
Stop file-type guessing, block clickjacking frames, keep page addresses to yourself and switch off camera and mic access you don't use.
A safe starter set for .htaccess
On Apache or most cPanel hosts, these lines are fine on almost any site. Add CSP later, once you've tested it:
Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"Header always set X-Content-Type-Options "nosniff"Header always set X-Frame-Options "SAMEORIGIN"Header always set Referrer-Policy "strict-origin-when-cross-origin"Header always set Permissions-Policy "camera=(), microphone=(), geolocation=()"
Only add HSTS once HTTPS works on every page, because browsers will hold you to it for a year.
Questions
What are security headers?
They're short instructions your server sends with every page. They tell the browser things like "only ever use HTTPS here" or "don't let other sites put me in a frame". Visitors never see them, but they shut a few common tricks for free.
Where do I add them?
Wherever your site's responses are set up. On Apache or most cPanel hosts that's the .htaccess file, on Nginx it's the server block, and on Cloudflare it's a Transform Rule. WordPress security plugins can add most of them too.
Will adding headers break my site?
The simple ones won't. nosniff, a referrer policy and SAMEORIGIN framing are safe almost everywhere. A CSP can block your own scripts if you get it wrong, so start it in report-only mode and switch over when the reports go quiet.
Is this a hacking test?
No. We send one request, the same kind your browser sends, and read what comes back. Nothing gets probed or guessed.
Is this the same as the full CrawlCare scan?
No. This page grades the headers. The full free scan also covers speed on mobile and desktop, SEO basics, your SSL certificate and email records, and emails you the report.
Want more quick checks? Try the SPF and DMARC checker, the page check or the WordPress plugin checker. Or run the full free scan.