>_ Tools / Security Headers Checker

Security Headers Checker

HTTP headers tell browsers how to protect your visitors. Enter a domain for a graded report, or paste headers from an internal system.

FreeNo sign-up

>_ What it checks

01CSP and HSTSThe two headers that stop most XSS and downgrade attacks.

02ClickjackingWhether other sites can load yours inside an iframe.

03Info leaksServer and framework versions you should hide.

04Copy-paste fixesReady nginx lines for every missing header.

>_ Guide

Headers we grade

Header	Protects against	Suggested value
Content-Security-Policy	XSS, card-skimming scripts	`default-src 'self'; frame-ancestors 'self'` as a start
Strict-Transport-Security	Downgrade to http on public Wi-Fi	`max-age=31536000; includeSubDomains`
X-Frame-Options	Clickjacking	`SAMEORIGIN`
X-Content-Type-Options	Browsers guessing file types	`nosniff`
Referrer-Policy	Leaking internal URLs to other sites	`strict-origin-when-cross-origin`
Permissions-Policy	Abuse of camera, microphone, location	`camera=(), microphone=(), geolocation=()`

Headers that reveal software versions, such as Server: nginx/1.18.0 or X-Powered-By: PHP/7.4, lose points because they help attackers match known CVEs.

Adding headers in nginx

server_tokens off;
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;
fastcgi_hide_header X-Powered-By;

Note that add_header inside a location block replaces all headers set at server level, so repeat them or use an include file. Test a Content-Security-Policy with Content-Security-Policy-Report-Only first: WordPress plugins and page builders often need inline scripts.

An A grade does not make a site secure

Headers are an extra layer. They do not fix flaws in application code such as SQL injection, broken access control or outdated WordPress plugins. That needs a real penetration test.

>_ FAQ

Frequently asked questions

What are HTTP security headers?

Instructions the server sends with every page telling the browser which protections to turn on, for example only use HTTPS, do not allow the site inside an iframe, and limit where scripts load from.

Which header matters most?

Strict-Transport-Security and Content-Security-Policy give the most protection. Start with HSTS because it is easy, then build a CSP step by step using report-only mode.

Why do results differ from what I see in DevTools?

The scan requests the homepage without your login cookies. CDNs and WAFs such as Cloudflare can also send different headers by location. Results are cached for up to 2 hours.

Can I check an internal or intranet system?

Yes, use the Paste headers tab. Run curl -I against the internal URL from your own network, paste the output, and it is graded in your browser without sending any data.

>_ Mission control

Want more than headers?

A web application penetration test by RC.MY's NACSA-licensed team finds real vulnerabilities, not just configuration gaps.

Get a quote ▸Explore services

>_ Tools

More free tools

Every tool is free, needs no sign-up, and is built by the RC.MY penetration testing team.

TOOLEmail Security CheckerSPF, DKIM and DMARC test. Can scammers send email as your company?Open tool ▸TOOLDomain Age CheckerWhen was this website created? Spot brand new scam shops.Open tool ▸TOOLWhat Is My IPYour public IP, internet provider and approximate location.Open tool ▸TOOLQR Code ScannerSee the real link or payee name behind a QR code before you pay.Open tool ▸

Also on RC.MY Surah Al-Mulk · Surah Yasin · Surah Al-Waqiah · Surah Al-Fatihah · Surah Al-Kahf · Surah Ar-Rahman · Ayat Kursi · Ayat 1000 Dinar · Doa harian