Security Headers Checker

Check Your Website Security Headers

Check your website's HTTP security headers instantly. FortPilot Security Headers Checker scans your website response headers and identifies missing, weak, or misconfigured security protections. Check CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, CORS and other important HTTP security headers.

Enter your website URL above to start a free security header scan.

What Are HTTP Security Headers?

HTTP security headers dictate how web browsers behave when interacting with your site. Properly configured headers are essential for preventing Clickjacking, Cross-Site Scripting (XSS), MIME-sniffing, and other common attacks.

When a browser requests a page from a web server, the server responds with the content along with HTTP response headers. Security headers are a subset of these headers that provide security instructions to the browser.

HTTP Security Headers We Check

Content-Security-Policy (CSP)

CSP helps protect websites against cross-site scripting (XSS), code injection, and other unwanted content execution by defining which dynamic resources are allowed to load.

Strict-Transport-Security (HSTS)

HSTS enforces secure (HTTP over SSL/TLS) connections to the server, protecting against protocol downgrade attacks and cookie hijacking.

X-Frame-Options

Provides clickjacking protection by indicating whether a browser should be allowed to render a page in a <frame>, <iframe>, <embed> or <object>.

X-Content-Type-Options

Prevents Google Chrome, Internet Explorer, and Firefox from MIME-sniffing a response away from the declared content-type, reducing the risk of drive-by downloads.

Referrer-Policy

Controls how much referrer information (sent via the Referer header) should be included with requests, protecting sensitive URL parameters.

Permissions-Policy

Allows a site to control which browser features and APIs can be used in the document or within embedded iframes.

CORS Headers

Cross-Origin Resource Sharing (CORS) headers like Access-Control-Allow-Origin control cross-origin resource access.

Content Security Policy (CSP) Checker

Content Security Policy (CSP) is an important browser security mechanism that helps protect websites against cross-site scripting (XSS), code injection and other unwanted content execution. FortPilot analyzes your CSP configuration and highlights potentially dangerous directives and weak policies.

Our checker specifically looks for issues such as the use of unsafe-inline, unsafe-eval, wildcard sources (*), missing default-src, weak script-src, and overly permissive frame-ancestors directives.

How to Check Security Headers

1. Enter your website URL: Enter the URL you want to analyze in the scanner above.
2. Start the scan: FortPilot retrieves the site's HTTP response headers.
3. Review the results: Identify missing, weak or incorrectly configured security headers.
4. Fix the issues: Update your server, application or reverse-proxy configuration and scan again.

How to Fix Missing Security Headers

Here are some examples of how to set security headers in common server configurations:

Apache

Header set X-Content-Type-Options "nosniff"

Nginx

add_header X-Content-Type-Options "nosniff" always;

Security Headers Checker FAQ

What is a security headers checker?

A security headers checker analyzes HTTP response headers and identifies missing or weak browser security protections.

What security headers should a website have?

Common security headers include CSP, HSTS, X-Content-Type-Options, X-Frame-Options, Referrer-Policy and Permissions-Policy. The appropriate configuration depends on the website and its application architecture.

What is a CSP checker?

A CSP checker analyzes a website's Content-Security-Policy configuration and helps identify potentially unsafe or overly permissive directives.

How do I check my website security headers?

Enter your website URL into the FortPilot Security Headers Checker to analyze its HTTP response headers.

Does FortPilot check CSP?

Yes. FortPilot analyzes CSP configuration as part of its security header validation.

What does a missing security header mean?

It means the server may not be providing a particular browser security control. The actual risk depends on the header, application, and configuration.