SiteSecura Logo
SiteSecura.
BROWSER DEFENSE POLICY INSPECTOR

HTTP Security Headers Checker

Inspect supported HTTP security headers including HSTS, Content-Security-Policy, and X-Frame-Options to harden your website against browser-side vulnerabilities.

Inspects HTTP response headers returned by your web server.Free plan: up to 3 scans / 24h

How to Use This Tool

Run an automated assessment in three straightforward steps.

1

Enter Web Address

Input your website domain (e.g. example.com). No code modifications or server installations are necessary.

2

Inspect HTTP Response

SiteSecura sends standard HTTP GET and HEAD requests, parsing every response header returned by your web server or CDN.

3

Copy Remediation Snippets

Review missing headers with exact syntax recommendations ready to paste into Nginx, Apache, or Cloudflare.

Verified Inspection Signals

Inspected HTTP Response Headers

SiteSecura checks whether your server returns defensive response headers and evaluates their directive configurations.

Strict-Transport-Security (HSTS)

HTTPS Enforcement

Instructs modern browsers to communicate strictly over encrypted HTTPS connections, preventing SSL stripping and downgrade attacks.

Content-Security-Policy (CSP)

XSS Defense

Restricts the origin domains from which scripts, styles, images, and fonts can load, mitigating Cross-Site Scripting (XSS) and data injection.

X-Frame-Options

Clickjacking Protection

Controls whether the website can be rendered inside an <iframe> or <frame>, blocking UI redress and clickjacking attacks.

X-Content-Type-Options

MIME-Sniffing Defense

Prevents browsers from MIME-type sniffing executable scripts disguised as user-uploaded images or text files (nosniff).

Referrer-Policy

Data Privacy

Governs how much sensitive referrer path data (including query parameters and session tokens) is leaked to external sites when navigating.

Permissions-Policy

Feature Governance

Explicitly disables browser hardware access (e.g. camera, microphone, geolocation) that your web application does not need.

Interpreting Scan Results

Every scan item receives an explicit status indicator to help you prioritize remediation.

Active (Green)

The header is configured with secure recommended directives (such as max-age >= 1 year for HSTS).

Needs Tuning (Amber)

The header is present but contains weak directives (such as short max-age, missing includeSubDomains, or permissive CSP).

Missing (Red)

An essential defensive browser header is entirely absent from production HTTPS responses.

Information (Blue)

Observed server banners (such as Apache, Nginx, or Cloudflare) and optional privacy directives.

Actionable Remediation

Practical Remediation Guidance

How to resolve common gaps and harden your server configurations.

Configuring defensive HTTP response headers is one of the quickest and highest-ROI security enhancements you can make. Here are production-ready baseline snippets:

Nginx Configuration (nginx.conf)Recommended
# 1. Enforce HTTPS strictly for 1 year including subdomains
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;

# 2. Prevent clickjacking
add_header X-Frame-Options "SAMEORIGIN" always;

# 3. Disable MIME-sniffing
add_header X-Content-Type-Options "nosniff" always;

# 4. Restrict Referrer leakage
add_header Referrer-Policy "strict-origin-when-cross-origin" always;

# 5. Disable unused hardware features
add_header Permissions-Policy "geolocation=(), microphone=(), camera=()" always;
Apache (.htaccess or httpd.conf)
<IfModule mod_headers.c>
  Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
  Header always set X-Frame-Options "SAMEORIGIN"
  Header always set X-Content-Type-Options "nosniff"
  Header always set Referrer-Policy "strict-origin-when-cross-origin"
</IfModule>

Assessment Limitations & Technical Scope

SiteSecura performs deterministic, non-intrusive perimeter checks. Understanding what a passive assessment cannot evaluate ensures responsible risk management:

  • •Security headers instruct client browsers; they cannot protect against backend server compromise or database vulnerabilities.
  • •A missing header is not automatically a critical flaw; impact depends on application features (e.g. whether user content is hosted).
  • •Does not dynamically execute all JavaScript or evaluate complex CSP nonces on deep authenticated dynamic paths.
  • •Web applications with existing legacy inline scripts may require gradual refactoring before enabling strict CSP.
  • •Header presence alone does not guarantee safety if policies use overly permissive wildcards (e.g. `script-src *`).

Recommended Technical Guides

Learn defensive concepts and architectural best practices from our engineering team.

Security Headers

What Are Security Headers and Why Do They Matter?

Read Guide
SSL/TLS

HTTPS vs SSL vs TLS: What's the Difference?

Read Guide
Website Security

What Is Website Security? A Complete Beginner's Guide

Read Guide

Related Security Utilities

Explore dedicated perimeter verification tools in the SiteSecura toolkit.

Full Scan

Website Security Scanner

Run an integrated evaluation covering HTTPS, certificates, security headers, and domain email authentication.

Launch Tool
SSL / TLS

SSL/TLS Certificate Checker

Inspect certificate expiration dates, CA issuer chain, SAN domain matching, and supported TLS protocol versions.

Launch Tool
Email Security

SPF, DKIM & DMARC Checker

Audit DNS email-authentication records to stop domain spoofing and phishing.

Launch Tool
Common Questions

Frequently Asked Questions

HTTP security headers provide a standardized way for your server to instruct visitors' web browsers on how to treat site content. They restrict malicious script execution (CSP), enforce transport encryption (HSTS), and block clickjacking (X-Frame-Options) without requiring complex client-side programming.
Comprehensive Security Assessment

Ready for a Complete Website Security Evaluation?

Run an end-to-end passive scan across HTTPS, SSL certificates, defensive HTTP response headers, and DNS email authentication records in under 60 seconds.

Launch Full Website Assessment