Security Headers Scanner
Checks that your site sends key HTTP security headers like CSP, HSTS and X-Frame-Options.
What it checks
This scanner reviews the HTTP security headers your site sends with each response, such as Content-Security-Policy, HSTS and X-Frame-Options. It checks which ones are present and which are missing. These are instructions your server gives the browser to protect itself.
Why it matters
Without these headers, the browser does not enable key protections and your site is more exposed to attacks like script injection or clickjacking. Many frameworks do not set them by default, so they are easy to forget. Their absence also lowers your score in security audits.
How to fix it
Add the missing headers in your server, CDN or framework configuration, wherever you define HTTP responses. Start with the most important ones: Content-Security-Policy, Strict-Transport-Security and X-Frame-Options. Many hosts like Vercel or Netlify let you set them in a headers file without touching code.
Check it on your site
Scan your site free and see if this and 44 other checks pass, with a fix prompt for every issue.
Scan my site free