Free security headers check

Four lines of configuration sit between most small business websites and the most common attacks on the web. They cost nothing, they are invisible to visitors, and they are missing from the large majority of sites we scan.

Check my security headers

Enter your website address. We run the check against your live site and show you this section of the results in a few seconds.

Website address Run my free headers check

Checks run against your live site. We record the website address you check, the pass, warn and fail counts, and your email address. We use your email to run the check, and to send marketing only if you tick the box. We do not sell, rent or share your details. Ten free scans per hour.

What this checks

• HTTPSGoogle ranks HTTP sites lower and browsers show a "Not Secure" warning.
• HSTS headerForces HTTPS even if a user types http://. Blocks downgrade attacks.
• X-Content-Type-OptionsStops the browser from guessing file types - a common attack vector.
• Content-Security-PolicyThe single biggest defence against injected scripts (XSS).

Why it matters

Security headers are instructions your server sends to the visitor's browser telling it how to behave on your site. They are not a product you buy. They are configuration you either have or do not, and most sites do not, because nothing ever prompts anyone to add them.

The consequences are real and ordinary. Without HSTS, somebody on the same cafe wifi can downgrade a visitor to an unencrypted connection. Without a Content-Security-Policy, a single injected script can quietly read everything typed into your checkout, which is exactly how British Airways lost twenty million pounds.

If you take card payments this stops being optional. PCI DSS version 4 made its script and page integrity requirements mandatory in March 2025, and those requirements are aimed squarely at this class of attack. Embedding somebody else's payment page does not take you out of scope.

How to fix it

1. Serve everything over HTTPS

   Certificates are free through Let's Encrypt and most hosts, including Bluehost, turn one on in a couple of clicks. Then redirect all http traffic to https so there is only one version of your site.

2. Add HSTS

   One header telling browsers to only ever connect to you over https, even if a visitor types the address without it. Start with a short max-age while you confirm nothing breaks, then raise it.

3. Add X-Content-Type-Options: nosniff

   Stops the browser guessing at file types, which is a long standing trick for making a browser treat an uploaded file as a script. It is a single line with essentially no downside.

4. Add a Content-Security-Policy

   The big one, and the only one that takes real care. It lists which sources are allowed to run scripts on your pages, so an injected script simply does not execute. Start in report-only mode, watch what it would have blocked, then enforce.

Questions

Is this the same as having an SSL certificate?

No. The certificate gives you the padlock and encrypts the connection. These headers govern what the browser is allowed to do once it is connected. Plenty of sites have a perfect padlock and none of these headers.

Will adding these break my website?

HSTS and nosniff are very low risk. A Content-Security-Policy genuinely can break things if you enforce it blindly, which is why it has a report-only mode that logs what it would have stopped without stopping anything. Use it for a week first.

I use Wix, Squarespace or Shopify. Can I change these?

Partly. Hosted platforms set most headers for you and generally handle HTTPS and nosniff sensibly. Your control over Content-Security-Policy is usually limited. The check still tells you where you stand, which is worth knowing before you assume the platform has it covered.

The other seven checks

Each one is free, instant and needs just your email address. Or run all 25 at once.

This is an automated check of what is publicly visible on your website. It is a plain language summary, not legal advice, and passing it does not by itself make you compliant with any particular law. Where a rule is mentioned, confirm it against the source before acting on it.