Free HTTP security headers checker
Enter a public URL. See whether the response sends HSTS, Content-Security-Policy, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, and Permissions-Policy, plus the deprecated X-XSS-Protection header.
Free, no signup. Checked October 2026. Suggested values are from the OWASP Secure Headers Project.
The check runs on the Uno Directory server. It requests the URL and reads the response headers. It does not run the page, and the URL is not added to the directory.
Paste an http or https URL, or type a domain such as example.com. A bare domain is requested over HTTPS. The path and query are kept.
Ports other than 80 and 443 are rejected. An IP address, localhost, and a name that resolves to a private or link-local address are rejected.
Click Check headers. Present means the final response included that header. Missing means it did not. The suggested value is the OWASP configuration proposal.
Final response. Redirect hops show the status code. The header rows are from the last response, after at most five redirects.
HSTS on HTTP. MDN says browsers ignore Strict-Transport-Security unless the response was HTTPS. The result says so when the final URL is HTTP.
Framing. X-Frame-Options and CSP frame-ancestors are shown together. OWASP says frame-ancestors is the one enforced when both are present.
X-XSS-Protection. MDN marks this header deprecated. OWASP recommends the value 0, which turns the old filter off.
How to read a security headers check
The suggested value on each row is copied from the configuration proposal on the OWASP Secure Headers Project best-practices page. Checked October 2026, that proposal is Strict-Transport-Security max-age=63072000; includeSubDomains, X-Frame-Options deny, X-Content-Type-Options nosniff, Content-Security-Policy default-src 'self'; form-action 'self'; base-uri 'self'; object-src 'none'; frame-ancestors 'none'; upgrade-insecure-requests, Referrer-Policy no-referrer, and a Permissions-Policy that disables a list of powerful features. The project says the same list can be used for a classic site or a web API, and that a Content-Security-Policy still has to be tuned for the page that will run it.
MDN's Strict-Transport-Security page says the header tells browsers to use HTTPS for that host, and to refuse a click-through of certificate errors on later visits. max-age is the memory period in seconds. includeSubDomains applies the rule to subdomains of that host, and MDN says it does not apply the rule to a parent domain. Browsers ignore the header when it arrives over HTTP. max-age=0 is how a host leaves the browser's HSTS list, and that instruction has to arrive over HTTPS. MDN says preload is not part of the HSTS specification. Using it requires max-age of at least 31536000 and includeSubDomains. MDN describes 63072000 as a two-year max-age. The OWASP proposal uses that number and does not include preload.
The OWASP response-header notes say a content security policy can prevent cross-site scripting, other cross-site injections, and clickjacking, and that it can also stop inline JavaScript or CSS from running. On the best-practices page, OWASP says form-action, base-uri, and frame-ancestors do not fall back to default-src. The bypass notes ask for form-action of at least 'self', base-uri of at least 'self', and frame-ancestors of at least 'none'. The same notes say X-Frame-Options is obsoleted by frame-ancestors: when both are present, frame-ancestors is enforced and X-Frame-Options is ignored. deny means no rendering in a frame. sameorigin means no rendering when the framing origin does not match. allow-from is not supported by modern browsers.
OWASP says X-Content-Type-Options: nosniff stops the browser from treating the body as a different MIME type than Content-Type. Referrer-Policy: no-referrer omits the Referer header entirely. Permissions-Policy replaces Feature-Policy. OWASP calls it a working draft and says the proposed value was generated for features supported by Chromium 140.0.7292.0. A site that needs the camera, payment, or another listed feature has to allow that feature. The suggestion is the proposal, and a shorter allowlist can be the right one for that site.
MDN's X-XSS-Protection page marks the header deprecated and non-standard. It describes the old filter in Internet Explorer, Chrome, and Safari, warns that the filter can create an XSS bug in an otherwise safe page, and says 0 disables filtering. OWASP's response-header note recommends X-XSS-Protection: 0 and says to use Content-Security-Policy instead. This checker always includes that note, whether or not the response sent the header.
The checker does not accept an IP address or localhost, and it will not connect when DNS returns a private, loopback, link-local, or other reserved address. That check runs again for each redirect. The certificate on the same host is a different check. The SSL certificate checker reads the certificate from a TLS handshake, including the issuer, the dates, and the subject alternative names.
Questions
Submit a tool to Uno Directory
Built a product founders should be able to find? List it on Uno Directory. A free listing needs a backlink badge. A paid listing goes live without one.
Submit a tool