HTTP Security Headers Checker - Audit CSP, HSTS, X-Frame-Options & OWASP Headers
Inspect any website’s live HTTP response headers against OWASP best practices, verify `Strict-Transport-Security` (HSTS), `Content-Security-Policy` (CSP), `X-Frame-Options`, `X-Content-Type-Options`, and `Permissions-Policy`.
Uses server processing
This tool sends your input to our server to process it.
Security & servers
Loading tool…
Server-assisted processingTry another tool
Instructions
How to use it
Follow these steps in the workspace above.
- Enter the full URL or domain you want to audit.
- Run the live HTTP header scan to fetch the server’s response headers.
- Review which security headers are present or missing, along with remediation guidance.
Guide
How it works
Auditing your HTTP response security headers against the OWASP Secure Headers Project takes seconds and helps protect browsers against cross-site scripting, framing overlays, MIME-type sniffing, and protocol downgrade issues.
The 6 Essential OWASP HTTP Security Headers
- Strict-Transport-Security (HSTS): Instructs browsers to connect exclusively over HTTPS.
- Content-Security-Policy (CSP): Restricts which origins can execute scripts, load styles, or embed frames.
- X-Content-Type-Options: Setting
nosniffprevents browsers from MIME-sniffing a response away from its declared Content-Type. - X-Frame-Options: Setting
SAMEORIGINorDENYblocks external sites from embedding your pages inside frames. - Referrer-Policy: Setting
strict-origin-when-cross-originprotects URL path parameters when users follow external links. - Permissions-Policy: Restricts unused browser hardware APIs like camera, microphone, and geolocation by default.
Need server configuration blocks to add missing headers? Use our Nginx Config Generator or Apache Config Generator.
Adding Strict-Transport-Security (HSTS), X-Content-Type-Options: nosniff, X-Frame-Options: SAMEORIGIN, and Referrer-Policy: strict-origin-when-cross-origin takes two minutes in Nginx, Apache, or Next.js config and breaks zero existing functionality.
Modern Chromium, Firefox, and Safari browsers have retired legacy XSS Auditor filters. Today, a properly configured Content-Security-Policy (CSP) is the recommended standard.
Define an async headers() function inside next.config.mjs returning the header array for your routes, or set them at your reverse proxy.
