Skip to content
ipaddress.fi

Security Headers Check

We fetch the response headers of a public URL (no body) and check the protective headers one by one.

Examples:

Some of the most effective web protections are plain HTTP response headers, set once on the server. This check fetches the response headers of a public URL, following redirects to the final page, and checks them one by one:

  • Strict-Transport-Security makes browsers use HTTPS only.
  • Content-Security-Policy limits where scripts and other resources may load from, and with frame-ancestors who may frame the page.
  • X-Content-Type-Options: nosniff stops browsers from guessing file types.
  • Referrer-Policy controls how much of the URL is passed on to other sites.
  • Permissions-Policy switches off browser features the site does not use.
  • Cross-Origin-Opener-Policy isolates the page from windows it opens.

It also flags software versions disclosed in Server or X-Powered-By. The result is a checklist, not a security rating: headers are one layer among many.

Frequently asked questions

Why is HSTS shorter than six months marked weak?

Browsers only remember the HTTPS requirement for max-age seconds. Six months to a year is the usual recommendation, and is required for the browsers' preload lists.

Is X-Frame-Options still needed?

The CSP frame-ancestors directive replaces it in modern browsers. Either one counts as framing protection here.

Does this tool send anything other than a normal request?

No. It sends one ordinary GET request per redirect hop, reads only the headers and closes the connection.

Related