Security Headers Checker
Every time a website sends a page, it can include short instructions telling your browser how to protect you: always use the secure version, don't let other sites wrap this page in a frame, only run scripts from places we trust. Enter a website to see which of these it sends, and what each one actually does.
Try , , or .
Is the certificate itself OK? The SSL Certificate Checker shows whether browsers trust it, when it expires, and whether phones and apps will accept it. Open SSL Checker →Headers are notes that travel with every page, invisible unless you go looking. A few of them are safety instructions, and the browser follows them to the letter. They don't fix bugs in a site, but they make many common attacks much harder to pull off.
HSTS makes the browser remember to use the secure version, so nobody on public Wi-Fi can quietly downgrade you to an insecure connection. Content Security Policy is a list of places the page may load scripts from, so a script an attacker sneaks in won't run. Frame protection stops other sites from showing this page inside theirs and tricking you into clicking buttons you can't see.
A missing header doesn't mean a site is hacked or unsafe to visit. These are extra layers, and plenty of well-run sites skip some of them. That's why we explain each one instead of handing out a letter grade.
We check the exact page you enter, after following any redirects. Free use is limited to 100 checks per day.
