HTTP security headers: what is a site sending, and what is missing?
How does this check work, and what does the result tell you?
Fetches a URL's response headers live via AdminKit's Check API and shows which recommended security headers (CSP, HSTS, X-Content-Type-Options, Referrer-Policy, Permissions-Policy and more) are present or missing, with the actual value sent for each one present, so a gap that would sit quietly in a site's configuration shows up before a browser fails to enforce the protection it should add.
Part of the Security basics cluster — more tools, guides and terms on security basics.
AI explanation Run a check below, then sign in to ask AI to explain the result in plain language.
Next step
Check the same host's TLS configuration, or see which ports are open on it.
Keep this result
Copy a link to this check so you can share it or run it again later. Want a heads-up when this result changes? Talk to our team and we'll set it up for you.
How it works and limits
HTTP response headers such as Content-Security-Policy and Strict-Transport-Security tell browsers how to defend a site’s visitors against clickjacking, mixed-content downgrades and cross-site scripting — but they only work once a site actually sends them, and it is easy to ship a site that never does.
What it checks
- Fetches the URL you enter and shows whether each recommended header (CSP, HSTS, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy) is present, with its actual value.
- The final URL reached, if the site redirects.
- Any specific issues the check flags, with a plain-language fix hint for each.
Limits
- This reads the response headers for one fetch of the URL you give it — it does not crawl the whole site or check every page.
- “Present” means the header was sent; it does not grade whether the policy’s actual value is strict enough for your use case.
Check manually today
curl -sI https://example.com/This prints the response headers directly. Compare the list against the OWASP Secure Headers Project’s reference table, or MDN’s HTTP headers reference, to see which are present and what each one should contain.
A reachable admin panel is a separate risk from missing security headers — see is port 8080 (admin panel) exposed? for that specific exposure check.
See best free HTTP security header analyzers for how this check compares to SecurityHeaders.com, Mozilla’s HTTP Observatory and Hardenize.
Frequently asked questions
Is this check live?
Yes — it fetches the URL you enter via AdminKit's Check API (POST /v1/check/http-headers), the same endpoint anyone can call anonymously, rate-limited per visitor.
What can I check manually today?
curl -I https://example.com/ prints the response headers directly from the command line.
Does it need a login or access any private page?
No — it only fetches the public response headers of the URL you give it, the same as a browser's first request to that page. It will not sign in, submit a form, or follow a login redirect.
Is a 'Present' header automatically correctly configured?
No — 'Present' means the header was sent at all; the value is shown alongside it so you can judge the actual policy (e.g. a Content-Security-Policy that is present but set to allow everything is still a gap). This is a configuration checklist, not a guarantee the site has no other vulnerabilities.