Security headers checker
Enter a domain and see which browser protections its homepage sends, and what to add. One page fetch, like a visitor makes.
What the result shows
- HSTS, nosniff, framing protection and Referrer-Policy
- Whether a Content-Security-Policy is set
- Whether the server names its software version
Read-only: the same lookups a browser or a mail server makes, nothing changed, nothing stored beyond ten minutes. What Stackbrace asks for.
What are security headers?
Lines the server sends with every page that tell the browser how to protect the visitor: use HTTPS only, do not guess file types, do not let other sites frame this one, do not pass full addresses on. They cost nothing and take minutes to add.
Which ones matter most?
Strict-Transport-Security, so a visitor typing the bare name is never sent over plain HTTP; X-Content-Type-Options: nosniff; and X-Frame-Options or frame-ancestors. Referrer-Policy is a courtesy to your visitors. A Content-Security-Policy is the strongest and the most work.
Where do I add them?
At the web server or the CDN: an .htaccess file on Apache, the server block on nginx, a Transform Rule on Cloudflare, or a security plugin on WordPress.
Every day, not just today
Stackbrace checks every site's headers and HTTPS set-up every day, as one of the four areas it rates a site by. Start free with one site.