Skip to content
StackSiren
Free scan

Free security headers checker

Paste your app's URL to see which HTTP security headers it sends, which are missing, and what each one protects against. One normal GET request, no signup.

Passive, read-only check. No signup, no email needed.

What this checks

  • Content-Security-Policy (and whether it uses unsafe-inline or unsafe-eval)
  • Strict-Transport-Security (HSTS) and its max-age
  • Clickjacking protection: X-Frame-Options or CSP frame-ancestors
  • X-Content-Type-Options: nosniff
  • Referrer-Policy and Permissions-Policy
  • Whether plain HTTP redirects to HTTPS

How it works (and what it never does)

  • We make one ordinary GET request to the page you enter, like a browser would.
  • We read the response headers and grade each one. Nothing is stored except an anonymous rate-limit counter.
  • Fix guidance links to our step-by-step guide for Vercel, Netlify, Lovable and Next.js.

Fix guides

FAQ

Which security headers does every site need?

At minimum: Strict-Transport-Security, X-Content-Type-Options: nosniff, clickjacking protection (frame-ancestors or X-Frame-Options), a Referrer-Policy and, ideally, a Content-Security-Policy. Permissions-Policy is a useful extra.

Is a missing CSP a vulnerability on its own?

Not by itself, but a Content-Security-Policy is the main defence that limits the damage if an attacker finds a way to inject script (XSS). Without one, injected script runs with full access to the page.

Does this checker attack my site?

No. It makes one normal GET request (plus one plain-HTTP request to test the HTTPS redirect) and reads the headers. It never sends payloads or logs in.

How do I add security headers on Vercel or Netlify?

Use the headers block in vercel.json or next.config.js on Vercel, or a _headers file on Netlify. Our security headers guide has copy-paste examples.

More free tools