FAST. PRIVATE. NO SIGN-UP.

Free Security Headers Checker

Inspect common browser-facing HTTP security headers from a live public response. Toolmera shows the exact values it receives and grades only the presence of the baseline header set plus HTTPS.

TOOLMERA / WEBSITE ANALYSIS
Security Headers Checker
Live public URL analysis
Toolmera fetches only public HTTP/HTTPS pages. Local/private hosts and non-standard ports are blocked, redirects are capped, and response bodies are size-limited.
Public-data onlyLive public HTTP/HTTPS checks
Instant workflowNo setup or account required
Free core toolOpen it and get the task done
WHY TOOLMERA

Built to get the task done.

  • Security header grade
  • Six common header checks
  • Live response evidence
ABOUT THIS TOOL

Free Security Headers Checker — Test HSTS, CSP & Browser Headers

Free security headers checker for HSTS, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy and Permissions-Policy.

Security headers checked by Toolmera

The report checks Strict-Transport-Security, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy and Permissions-Policy. These headers address different browser behaviors, so the tool reports them separately instead of collapsing every security concern into one vague score.

The grade is intentionally simple: it reflects HTTPS plus the number of checked headers present. It does not prove that a policy is perfectly configured, that an application has no vulnerabilities or that every missing header is required for every site.

CSP, framing and MIME protections solve different problems

Content-Security-Policy can constrain where scripts, styles and other resources may load from. X-Frame-Options controls older framing behavior, while frame-ancestors in CSP can provide more flexible framing policy. X-Content-Type-Options: nosniff asks browsers not to reinterpret declared MIME types.

Referrer-Policy governs referrer information sent with requests, and Permissions-Policy can restrict access to selected browser features. HSTS is transport-focused and is only meaningful when served over HTTPS.

Use the result as a configuration review, not a penetration test

A header checker is useful after CDN changes, framework upgrades, reverse-proxy migrations or security hardening because headers can disappear at the edge even when application configuration looks correct.

It is not a vulnerability scanner. Authentication flaws, insecure APIs, exposed secrets, dependency vulnerabilities and application logic require separate security testing.

HOW IT WORKS

How to use Security Headers Checker

01

Enter a public page URL

Choose a representative production URL served through the same CDN or reverse proxy as the site.

02

Inspect six baseline headers

Check HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy and Permissions-Policy values.

03

Test changes before enforcing them

Add or tighten headers carefully, especially CSP, then rerun the live check after deployment.

SOURCES

Reference material used for this page:

MDN HTTP headersOWASP HTTP Headers Cheat Sheet
KEEP GOING

Related tools

Useful next steps in the same workflow.

FAQ

Common questions

What security headers does Toolmera check?

It checks HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy and Permissions-Policy.

Does an A grade mean the website is secure?

No. The grade reflects the presence of the checked headers and HTTPS, not overall application security.

Is Content-Security-Policy always easy to add?

No. A strict CSP can break scripts or resources if it is deployed without testing. Start with an inventory and rollout plan appropriate to the application.

Why can a CDN change security headers?

Reverse proxies and edge platforms can add, remove or override response headers after the application generates a response.

Can this replace a penetration test?

No. It is a fast HTTP header inspection tool, not a penetration test or vulnerability assessment.