Skip to content
PixelPrivate
Log inFree trial
Menu
Attack Surface & ExposureEmail & Brand ProtectionData ExposureTrust & CompliancePolicy & AccessPlatform overviewCEOs of growing companiesCFOs and finance leadersManufacturingSaaSE-commerceHealthcare and clinicsProfessional servicesAgencies and MSPsCyber-insurance readinessReal casesScenariosFree toolsLearnPricingLog inStart 14-day free trial

Free tool

Security headers checker

Security headers are instructions your server sends that switch on browser protections, such as forcing HTTPS or limiting where scripts can load from. They are cheap to add and reduce the impact of several common web attacks.

No credit card. Only scan domains you own or are authorized to assess. PixelPrivate performs passive, public checks only.

What this checks

  • Strict-Transport-Security (HSTS), rated medium when missing on an HTTPS site
  • Content-Security-Policy and Permissions-Policy, treated as recommendations
  • X-Content-Type-Options and Referrer-Policy
  • Clickjacking protection
  • Optional hardening notes: Cross-Origin-Opener-Policy and Cross-Origin-Resource-Policy
  • Cookie Secure, HttpOnly and SameSite flags

How to use it

  1. Enter your domain.
  2. Read the header table to see which headers are present and which are missing.
  3. For each missing header, copy the suggested value.
  4. Add headers in your hosting dashboard, CDN rules or web-server config.
  5. Roll out CSP in report-only mode first.

Methodology and limitations

Headers are read from the homepage response only. PixelPrivate performs passive checks against publicly visible configuration only. It does not test for exploitable vulnerabilities, so a clean result is not a guarantee of security. Read the full security methodology.

Key terms

  • Security headers — Security headers are HTTP response headers that switch on browser protections, such as forcing HTTPS, restricting script sources, or stopping your pages being framed by other sites..
  • Content-Security-Policy (CSP) — Content-Security-Policy is an HTTP header that tells browsers which sources of scripts, styles, images and frames your pages are allowed to use..
  • HSTS — HTTP Strict Transport Security (HSTS) is a response header that tells browsers to only ever connect to your site over HTTPS..

Frequently asked questions

Which header matters most?

HSTS and a sensible Content-Security-Policy give the most benefit, but CSP takes the most care to deploy.

Does a missing header mean my site is vulnerable?

No. It means a defence-in-depth control is absent. PixelPrivate rates these as low-to-medium severity accordingly, and never as critical. A missing Content-Security-Policy is a recommendation, not a sign that your site was hacked.

Keep this check running automatically

Create a free account to save results, track your score and get alerted when something changes.

Create free account

Related tools

Related guides