Security headers check
Enter a domain to see which of the five key security headers your homepage is missing: CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy and HSTS.
Want a ready-made config? Generate your security headers config for free for nginx, Apache or Cloudflare.
What are security headers?
They are lines your server sends with every page that tell the browser to switch on extra protection. They don't replace patching, but they block several common attacks for almost no cost: a few lines of config.
| Header | What it does | Suggested value |
|---|---|---|
| Content-Security-Policy | Limits where scripts, images and styles can load from; reduces the damage of injected code (XSS). | Start with Report-Only |
| X-Frame-Options | Stops your page being embedded in a phishing site's iframe (clickjacking). | SAMEORIGIN |
| X-Content-Type-Options | Stops browsers guessing file types, so an uploaded file can't be run as a script. | nosniff |
| Referrer-Policy | Doesn't leak full URLs (which may contain codes or tokens) to other sites when visitors click out. | strict-origin-when-cross-origin |
| Strict-Transport-Security | Forces browsers to always use HTTPS for your domain. | max-age=31536000 |
Example configs
nginx:
# nginx: inside server { ... }, then nginx -t && systemctl reload nginx
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
add_header Content-Security-Policy-Report-Only "default-src 'self'; img-src 'self' data: https:; script-src 'self' 'unsafe-inline' https:; style-src 'self' 'unsafe-inline' https:; frame-ancestors 'self'" always;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;Apache:
# Apache: .htaccess or VirtualHost (needs: a2enmod headers) <IfModule mod_headers.c> Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains" Header always set Content-Security-Policy-Report-Only "default-src 'self'; img-src 'self' data: https:; script-src 'self' 'unsafe-inline' https:; style-src 'self' 'unsafe-inline' https:; frame-ancestors 'self'" Header always set X-Frame-Options "SAMEORIGIN" Header always set X-Content-Type-Options "nosniff" Header always set Referrer-Policy "strict-origin-when-cross-origin" </IfModule>
Cloudflare: Rules → Transform Rules → Modify Response Header → Create rule → All incoming requests → add each header with “Set static” → Deploy.
The CSP above is Report-Only, so it blocks nothing and only logs to the console. Watch it for a few days, adjust the sources to fit your site, then rename the header to Content-Security-Policy.
Check your whole site, not just one thing
The free scan checks SSL, email spoofing, security headers, exposed sensitive files, outdated CMS and signs of hacking in one go, with plain-language fixes.
Free once you verify your domain: weekly re-scans and email alerts for new issues. PRO ($8/month): deep scan with 5,000+ known-vulnerability checks, deep re-scans up to 10 times a day and 5-minute uptime monitoring.
FAQ
Will adding a Content-Security-Policy break my site?
It can, if it blocks scripts or fonts the page needs. Start with Content-Security-Policy-Report-Only, read the violations in the browser console, adjust, and only then switch to enforcing mode.
I'm on shared hosting and can't edit nginx. Where do I add headers?
Most shared hosts run Apache, which lets you add headers in the .htaccess file in your site root. If your domain is behind Cloudflare, you can add them with Transform Rules without touching the host.
What's the difference between X-Frame-Options and frame-ancestors?
Both stop your page being framed. frame-ancestors is the newer CSP directive and is more flexible; keep X-Frame-Options for older browsers. Setting both doesn't conflict.
Which page does this check?
Your homepage over HTTPS. Other pages served by a different app may send different headers, so set headers at the server or Cloudflare level to cover the whole site.