HTTP security headers test: check HSTS, CSP & more

This free test grades your website's HTTP security headers across more than 30 individual checks – from HSTS and the quality of your Content-Security-Policy to cookie flags, CORS, mixed content and information leaks – and gives you a concrete recommendation for every finding. Check your domain →

The five must-have headers

Strict-Transport-Security (HSTS): forces HTTPS and prevents SSL stripping. The test grades the lifetime (max-age ≥ 1 year for full marks); max-age=0 is a mistake, because it actively deletes an existing policy from the browser. It also checks whether you meet the requirements for the HSTS preload list.
Content-Security-Policy (CSP): the most effective layer of defence against XSS – see below.
X-Content-Type-Options: nosniff: stops browsers from guessing content types and, for example, executing text as a script.
Clickjacking protection: today via frame-ancestors in the CSP, with X-Frame-Options serving as a fallback for older browsers.
Referrer-Policy: limits which URL data leaks when you click an external link.

Getting your CSP right

A plain host allowlist with unsafe-inline is often bypassable – strong policies are nonce- or hash-based and use strict-dynamic. That is why the test grades not just whether a CSP is set, but how good it is: unsafe sources (unsafe-inline, unsafe-eval, wildcards), hardening directives (object-src, base-uri, form-action), upgrade-insecure-requests, Trusted Types, sandbox, and whether violations are reported. A policy that runs in report-only mode does not protect you yet.

Cookies: Secure, HttpOnly, SameSite

Cookies without Secure can be read over HTTP, without HttpOnly they can be stolen via JavaScript (XSS), and without SameSite they can be abused for CSRF. The test checks every cookie you set for these attributes and also recognises the __Host-/__Secure- name prefixes, which force the attributes on the browser side.

Remove obsolete headers

X-XSS-Protection: the browser auditor was removed and could create vulnerabilities of its own (XS-Leaks) – drop it or set it to 0.
Expect-CT: obsolete now that Certificate Transparency is mandatory for every certificate.
HPKP (Public-Key-Pinning): withdrawn and no longer supported by browsers – too risky to operate.

What else the test checks

Cross-origin isolation (COOP/COEP), Permissions-Policy, Origin-Agent-Cluster, mixed content, Subresource Integrity, CORS configuration (Access-Control-Allow-Origin wildcards), Cache-Control on authenticated responses, technology disclosure through Server/X-Powered-By banners and the security.txt (RFC 9116). The full grading logic for every check is in the explanations.

Frequently asked questions

Which security headers are the most important?

Five headers form the baseline: Strict-Transport-Security (HSTS) forces HTTPS, the Content-Security-Policy limits the damage of XSS, X-Content-Type-Options: nosniff prevents MIME sniffing, frame-ancestors (or X-Frame-Options) protects against clickjacking, and the Referrer-Policy limits data leaking through the referer. Everything else is additional hardening.

Should I still set X-XSS-Protection?

No. The browsers' XSS auditor was removed and could cause security problems of its own (XS-Leaks). The header should be omitted or set to 0; the actual XSS protection today comes from the Content-Security-Policy.

How does this test differ from securityheaders.com?

securityheaders.com established header grading as a standalone tool. This test checks the headers as one of six modules in the context of the whole domain – and additionally covers cookie flags, CORS configuration, Cache-Control on authenticated responses, mixed content and information leaks such as server banners. Detailed comparison →

Sources

RFC 6797 (HSTS) ↗ · W3C CSP Level 3 ↗ · OWASP Secure Headers Project ↗ · RFC 9116 (security.txt) ↗