Security headers checker: does this site send HSTS, CSP and X-Frame-Options?
In short: Paste websites and see, for each home page, whether Strict-Transport-Security, Content-Security-Policy, clickjacking protection and nosniff are set, and which are weak. Limit: The home page only; other paths can send different headers.
A security headers checker loads a website's home page and reads the HTTP response headers that tell browsers how to protect visitors. Paste one site or up to 100 (500 after a Google sign-in): each gets HSTS, Content-Security-Policy, X-Frame-Options or frame-ancestors, and X-Content-Type-Options marked set, weak or missing, plus Referrer-Policy and Permissions-Policy for reference.
Price: this tool is free. Checking a whole email list is from $9/mo, and the first 100 checks are free with Google, no card. See pricing
Sample result
acme.example sends all four core security headers; globex.example has no Content-Security-Policy.
- Website
- acme.example
- HSTS
- 365 days
- CSP
- Set
What this means for you
See which sites leave browsers without HSTS, a CSP or clickjacking protection.
- HSTS, CSP, frame protection and nosniff
- Weak values explained, not just missing ones
- Raw header values in the CSV
- 100 sites a run, 500 when signed in
- HSTS
- CSP
- Headers
By SimpleVerifier Team · Last updated
Auditing every site in a portfolio or a client list?
- Over 500 sites? Run them in batches of 500 when signed in and download the CSV after each.
- Check their certificates too with the bulk SSL checker, and that each site is up with the bulk website status checker.
- Emailing the owners of these sites? Check the list at /verify. The first 100 email checks are free with a Google sign-in, no card.
How do I check a website's security headers?
- Paste one website or a list, one per line: up to 100 a run, or 500 after a free Google sign-in. URLs are trimmed to the host name; www. is kept.
- Press Check headers. Each home page is fetched over HTTPS (plain HTTP if HTTPS doesn't answer), following up to five redirects.
- Read each site's verdict and the note on every header: missing, weak (and why), or set.
- Download the CSV with the raw header values to hand to whoever runs the site or its CDN.
Example
- You enter
- Three websites:
acme.example,www.globex.exampleandinitech.example. - You get
acme.exampleAll four set: HSTS max-age 365 days with includeSubDomains, a CSP with script-src, frame-ancestors 'self' and nosniff.www.globex.exampleSome missing: HSTS max-age is only 30 days (weak) and there is no Content-Security-Policy.initech.exampleMostly missing: only nosniff is sent. Download the CSV with every header value.- Limits
- Up to 100 websites a run without an account and 500 when signed in with Google. The home page only.
Which security headers matter?
Four decide the verdict. Strict-Transport-Security (HSTS) makes browsers use HTTPS for the host for max-age seconds; the HSTS preload list asks for at least one year. Content-Security-Policy limits where scripts and other resources may load from, which blunts cross-site scripting. Clickjacking protection stops other sites framing the page: CSP frame-ancestors, or the older X-Frame-Options DENY or SAMEORIGIN. X-Content-Type-Options: nosniff (Fetch standard) stops browsers guessing a file's type.
Referrer-Policy and Permissions-Policy are shown but don't count against the site: browsers already default to strict-origin-when-cross-origin, and Permissions-Policy only switches off features a page could otherwise ask for.
When is a header there but weak?
HSTS with no valid max-age, max-age=0, or under a year. A CSP sent only as Content-Security-Policy-Report-Only (it reports but blocks nothing), one with no script-src or default-src, or one that allows 'unsafe-inline' scripts without a nonce or hash. X-Frame-Options ALLOW-FROM, which current browsers ignore. nosniff with any other value. Each note says which case applies.
Who uses this tool, and for what?
- Agencies
- Show clients which of their sites lack HSTS or a CSP before a security audit.
- IT teams
- Audit every company website and microsite for the same baseline headers.
- Developers
- Confirm a CDN or framework change still sends the headers after deploy.
- Sales teams
- Qualify web-security prospects by which headers their sites are missing.
What can’t this tool tell you?
- The home page only; other paths can send different headers.
- It reads headers; it doesn't test the site for vulnerabilities or judge whether a CSP fits the site.
- Sites that block automated requests or need cookies may show an error page's headers.
- Up to 100 sites a run without an account and 500 signed in.
Common questions
- Which page does the checker read?
- The home page only, after redirects: the headers of the final response. Other pages, API routes or assets on the same site can send different headers.
- Is X-XSS-Protection checked?
- No. Current browsers have removed the XSS auditor that header controlled, and a Content-Security-Policy does that job instead.
- Why does my site show different headers in my browser?
- A CDN or firewall can send different responses to different clients, or block automated requests. The checker sends a plain GET with its own user agent and no cookies.
- Does a missing header mean the site is insecure?
- Not by itself. These headers add defence in depth in the browser; they don't fix or reveal vulnerabilities in the site itself.
- Can I check many sites at once?
- Yes. 100 sites a run without an account and 500 after a free Google sign-in, with a CSV of every header value.
- Is the security headers checker free?
- Yes, it's a free tool with no card. One GET of each home page, at most 32 KB read.
Sources
You audited one domain. Cold outreach means thousands.
This tool checks a domain you type in. It will not tell you which addresses at that domain are real.
- Bulk mailbox verification with real SMTP checks
- The email finder — name plus company to a verified address
- Website enrichment for emails, owner names and socials
Plans from $9 a month, cancel anytime, no contract. Sign in with Google and your first 100 email checks are free, no card. The free tools stay free either way.