What security headers should I enable?

At minimum: HSTS, CSP, X-Frame-Options, and X-Content-Type-Options. Referrer-Policy and Permissions-Policy provide additional protection.

How is the security score calculated?

The score is based on the presence of recommended headers, with weights: HSTS (20), CSP (20), X-Frame-Options (15), X-Content-Type-Options (15), Referrer-Policy (10), Permissions-Policy (10).

Can headers be configured incorrectly?

Yes. The tool warns about unsafe CSP directives, incorrect X-Frame-Options values, cookie security issues, CORS misconfigurations, and other problems.

What cookie flags should I use?

Use Secure (HTTPS only), HttpOnly (no JavaScript access), and SameSite=Strict or Lax to prevent CSRF attacks.

Which TLS version is secure?

TLS 1.3 is the most secure. TLS 1.2 is acceptable but consider upgrading. TLS 1.0/1.1 and SSL are deprecated and insecure.

Security Headers Checker - Verify HTTP Security Headers | Shub Raj Apps

Security Headers Checker

Check security headers configuration for any domain. Get a comprehensive security audit with recommendations.

Comprehensive Security Headers Audit for Any Domain

Verify that a domain implements recommended HTTP security headers. This tool checks HSTS, Content-Security-Policy, X-Frame-Options, and other critical headers, providing a security score and actionable recommendations.

Security Headers Checked

Strict-Transport-Security (HSTS): Forces HTTPS connections and prevents downgrade attacks.
Content-Security-Policy (CSP): Reduces XSS risks by controlling which resources can load.
X-Frame-Options: Prevents clickjacking by controlling iframe embedding.
X-Content-Type-Options: Stops MIME-type sniffing attacks.
Referrer-Policy: Controls how much referrer information is sent.
Permissions-Policy: Restricts access to browser features and APIs.
Cross-Origin Policies (COEP/COOP/CORP): Control cross-origin resource sharing and isolation.

Additional Security Checks

Cookie Security: Analyzes Secure, HttpOnly, and SameSite flags on all cookies.
TLS Version: Verifies the TLS/SSL protocol version (TLS 1.2+ recommended).
CORS Policy: Reviews Cross-Origin Resource Sharing configuration and identifies misconfigurations.
Information Disclosure: Detects headers that reveal server versions, frameworks, or infrastructure details.

What the Security Score Means

Excellent (80-100%): Most critical headers are present and properly configured.
Good (60-79%): Major security headers are in place with room for improvement.
Fair (40-59%): Some headers missing; security could be significantly improved.
Poor (<40%): Critical headers are missing; site is vulnerable to common attacks.

Use Cases

Security audits: Verify your own site's header configuration before launch.
Compliance checks: Ensure headers meet security standards and policies.
Third-party audits: Evaluate partner sites or vendor security configurations.
Continuous monitoring: Track header changes over time.

Best Practices

Enable HSTS with max-age of at least 1 year and includeSubDomains.
Use a strict CSP that avoids unsafe-inline and unsafe-eval when possible.
Set X-Frame-Options to DENY or SAMEORIGIN based on your needs.
Always include X-Content-Type-Options: nosniff.
Remove information-disclosing headers like X-Powered-By and Server.