Free Bulk Security Headers Checker

Security headers tell browsers how to protect your visitors from clickjacking, cross-site scripting and data leaks. Check up to 20 sites at once, with a grade and plain-English fixes.

Quick human check, then the tool unlocks:

Websites or page addresses (one per line, up to 20)

What each header does

Strict-Transport-Security (HSTS): browsers always use HTTPS for your site, even if someone types http://.
Content-Security-Policy: limits where scripts, styles and pictures may load from. The strongest protection against cross-site scripting.
X-Frame-Options (or CSP frame-ancestors): stops other sites showing yours in a frame to trick people into clicking (clickjacking).
X-Content-Type-Options: nosniff: stops browsers treating files as a different type than the server says.
Referrer-Policy: controls how much of your page address is passed on when visitors click links to other sites.
Permissions-Policy: switches off features you don't use, such as the camera, microphone and location.
Cookies should be marked Secure and HttpOnly, with a SameSite setting.

Headers are added in your web server or hosting settings (for Apache, in .htaccess), in your CDN (such as Cloudflare), or with a security plugin on WordPress.

🔒 The sites you check are not saved or logged.