Infrastructure
HTTP Security Headers Checker
Inspect important HTTP response headers and identify missing browser security controls.
How to use this tool
Enter a public HTTPS page to check CSP, HSTS, content-type, framing, referrer and permissions policies.
Related tool: Redirect Checker →When to use the HTTP Security Headers Checker
Use it to see which browser security headers a site sends, such as HSTS, CSP and X-Frame-Options, and which are missing.
Examples
- Check a WordPress site after adding HSTS in Nginx.
- Find a missing Content-Security-Policy before a security review.
Common mistakes
- Enabling HSTS preload before every subdomain supports HTTPS.
- A CSP so strict it breaks scripts, then removing it entirely.
Created by Muhammad Irfan Aslam, Senior Systems & Cloud Engineer.
Case study: WordPress on AWS Lightsail with Nginx and Varnish →Tutorial on LearnWithIrfan: Nginx security hardening →