Security Headers Checker
Verify HSTS, CSP, X-Frame-Options and more — no signup required
Strict-Transport-Security
HSTS header — forces browsers to use HTTPS for a specified period.
Content-Security-Policy
CSP header — prevents XSS and data injection attacks.
X-Frame-Options
Prevents clickjacking by controlling iframe embedding.
X-Content-Type-Options
Prevents MIME-type sniffing (nosniff).
Referrer-Policy
Controls how much referrer information is shared.
Permissions-Policy
Restricts browser features (camera, microphone, geolocation).
Cross-Origin Policies
CORP, COEP, COOP headers for cross-origin isolation.
Cookie Security
Secure, HttpOnly, SameSite attributes on all cookies.
This tool is a small window into the full engine
The complete audit runs 272 scanners — OWASP, SQL injection, WordPress suite (WPScan), technology fingerprinting (WhatWeb), the full 13,000-template Nuclei pack, and exploit-availability intelligence from ExploitDB & Metasploit — in one professional report.
Get a complete security audit
This checker covers a fraction of our 276-scanner assessment. Run a full scan for a complete report.