Free tool · Headers · Cookies
Free security headers check for your website.
Security headers tell browsers how to protect your users. Missing or weak headers are among the most common findings in any penetration test, and they are quick to fix.
A security headers check reads the HTTP response headers your website sends and reports which protections are missing or misconfigured: Content-Security-Policy, Strict-Transport-Security, X-Frame-Options or frame-ancestors, X-Content-Type-Options, Referrer-Policy, Permissions-Policy and the Secure, HttpOnly and SameSite flags on cookies.
What each security header does
| Header | What it protects against | A good value |
|---|---|---|
| Content-Security-Policy | Cross-site scripting and injected content | A policy without 'unsafe-inline' or 'unsafe-eval', for example default-src 'self' |
| Strict-Transport-Security | Downgrade to HTTP and cookie theft | max-age=31536000; includeSubDomains |
| X-Frame-Options / frame-ancestors | Clickjacking | DENY or SAMEORIGIN, or CSP frame-ancestors 'self' |
| X-Content-Type-Options | MIME-type sniffing | nosniff |
| Referrer-Policy | Leaking URLs to other sites | strict-origin-when-cross-origin |
| Permissions-Policy | Unwanted use of camera, microphone or location | Disable features you do not use |
| Set-Cookie flags | Session theft and cross-site requests | Secure; HttpOnly; SameSite=Lax or Strict |
| Server / X-Powered-By | Version disclosure that helps attackers | Removed or generic |
Frequently asked questions
What are HTTP security headers?
Response headers that instruct the browser to enable protections, such as blocking framing, enforcing HTTPS or restricting which scripts may run.
Which security headers are most important?
Content-Security-Policy and Strict-Transport-Security, followed by clickjacking protection, X-Content-Type-Options and correct cookie flags.
Is a headers check enough for a penetration test?
No. Headers are scanner-level findings. Access control, business logic and chained attacks need an expert-led penetration test.
More free tools
Headers fixed? Find what a scanner cannot.
Sumrite’s expert-led testing covers access control and business logic.