Free tool

Security Headers Check

Security headers are set once and protect every page — yet most AI-built apps ship without them. This checks the four headers a professional review looks for first.

What this checks

✓No Content-Security-Policy Security header
✓No HSTS (or lifetime too short) Security header
✓No clickjacking protection Security header
✓No nosniff header Security header

How the check works

We fetch your page over HTTPS and inspect the response headers — the same ones every browser receives. We check for Content-Security-Policy, Strict-Transport-Security (HSTS), clickjacking protection (X-Frame-Options or frame-ancestors) and X-Content-Type-Options: nosniff. Passive, read-only, nothing stored.

Common questions

Are missing security headers a GDPR issue or a security issue?

Both. Technically they harden your site against script injection, clickjacking and downgrade attacks; legally they fall under Art. 32 GDPR — appropriate technical measures for protecting personal data.

Where do I set these headers?

At the hosting layer, once: a _headers file on Netlify, vercel.json on Vercel, or your reverse proxy config. Each of our check pages shows the exact fix for common platforms.

Which header matters most?

Content-Security-Policy — it limits what injected or compromised scripts can do. HSTS is second: it pins browsers to HTTPS. The other two are one-liners you set at the same time.

All free tools · every check explained · run the full 15-point check