Skip to content
app.shubraj.com

Security Headers Checker

Check security headers configuration for any domain. Get a comprehensive security audit with recommendations.

More in Network & Security

HTTP Headers Checker

Subnet/CIDR Calculator

SSL Certificate Checker

HSTS Checker

Redirect Chain Analyzer

Domain Age Checker

Comprehensive Security Headers Audit for Any Domain

Verify that a domain implements recommended HTTP security headers. This tool checks HSTS, Content-Security-Policy, X-Frame-Options, and other critical headers, providing a security score and actionable recommendations.

Security Headers Checked

  • Strict-Transport-Security (HSTS): Forces HTTPS connections and prevents downgrade attacks.
  • Content-Security-Policy (CSP): Reduces XSS risks by controlling which resources can load.
  • X-Frame-Options: Prevents clickjacking by controlling iframe embedding.
  • X-Content-Type-Options: Stops MIME-type sniffing attacks.
  • Referrer-Policy: Controls how much referrer information is sent.
  • Permissions-Policy: Restricts access to browser features and APIs.
  • Cross-Origin Policies (COEP/COOP/CORP): Control cross-origin resource sharing and isolation.

Additional Security Checks

  • Cookie Security: Analyzes Secure, HttpOnly, and SameSite flags on all cookies.
  • TLS Version: Verifies the TLS/SSL protocol version (TLS 1.2+ recommended).
  • CORS Policy: Reviews Cross-Origin Resource Sharing configuration and identifies misconfigurations.
  • Information Disclosure: Detects headers that reveal server versions, frameworks, or infrastructure details.

What the Security Score Means

  • Excellent (80-100%): Most critical headers are present and properly configured.
  • Good (60-79%): Major security headers are in place with room for improvement.
  • Fair (40-59%): Some headers missing; security could be significantly improved.
  • Poor (<40%): Critical headers are missing; site is vulnerable to common attacks.

Use Cases

  • Security audits: Verify your own site's header configuration before launch.
  • Compliance checks: Ensure headers meet security standards and policies.
  • Third-party audits: Evaluate partner sites or vendor security configurations.
  • Continuous monitoring: Track header changes over time.

Best Practices

  • Enable HSTS with max-age of at least 1 year and includeSubDomains.
  • Use a strict CSP that avoids unsafe-inline and unsafe-eval when possible.
  • Set X-Frame-Options to DENY or SAMEORIGIN based on your needs.
  • Always include X-Content-Type-Options: nosniff.
  • Remove information-disclosing headers like X-Powered-By and Server.

Frequently asked questions

What security headers should I enable?

At minimum: HSTS, CSP, X-Frame-Options, and X-Content-Type-Options. Referrer-Policy and Permissions-Policy provide additional protection.

How is the security score calculated?

The score is based on the presence of recommended headers, with weights: HSTS (20), CSP (20), X-Frame-Options (15), X-Content-Type-Options (15), Referrer-Policy (10), Permissions-Policy (10).

Can headers be configured incorrectly?

Yes. The tool warns about unsafe CSP directives, incorrect X-Frame-Options values, cookie security issues, CORS misconfigurations, and other problems.

What cookie flags should I use?

Use Secure (HTTPS only), HttpOnly (no JavaScript access), and SameSite=Strict or Lax to prevent CSRF attacks.

Which TLS version is secure?

TLS 1.3 is the most secure. TLS 1.2 is acceptable but consider upgrading. TLS 1.0/1.1 and SSL are deprecated and insecure.