What are HTTP security headers?
Learn what common response security headers do and how to inspect them on a public URL.
The short answer
HTTP security headers are response instructions that help browsers apply safer defaults when loading a website.
Use the free Headers CheckerUse the free Website Score CheckerUse the free SSL Certificate CheckerStep by step
- Enter a public URL in Headers Checker.
- Review HSTS, content type, referrer, permissions, and CSP signals in context.
- Check that the policy matches the resources the site actually needs.
- Test changes in staging before applying them broadly.
Technical details
- CSP can reduce script injection risk; HSTS requires careful rollout; X-Content-Type-Options prevents MIME sniffing in supported browsers.
Common mistakes
- Copying a restrictive CSP without testing.
- Treating headers as a replacement for input validation.
- Using security headers to conceal a broken application.
Limitations
- A header check observes the response; it does not prove the entire application is secure.
Related SiteIndex tool
Review HTTP response headers for caching, content type, security, and debugging information.
Use Headers CheckerLearn moreMeasure a public website's SEO, performance, accessibility, security, and technical health.
Use Website ScoreLearn moreCheck an SSL certificate's expiry date, issuer, covered hostnames, chain of trust, and TLS version for any domain.
Use SSL CheckerLearn more