Security Headers Check

With every page, your server sends invisible extra information to the browser. Some of it works like small safety switches: it enforces the encrypted connection, prevents other sites from embedding your website and makes injected code harder. The check shows within seconds which switches are set, gives a grade and provides the matching snippet for the simple headers.

How to read the result

At the top you see a grade from A+ to F. Like securityheaders.com it is based on six important headers, the grade there may differ slightly. The traffic light below is weighted realistically: red only appears for real gaps, for example when your website is reachable unencrypted. Missing extra switches are yellow or just a note.

OKThis point is implemented correctly.
ReviewNot an acute error, but room for improvement.
ProblemLikely has a negative effect and should be fixed.
InfoFor information, without rating.

HTTPS and redirect

We also open your address with http://. Anyone arriving this way should be redirected to the encrypted version immediately. If the server delivers the page unencrypted, form entries can be intercepted.

HSTS

Strict-Transport-Security tells the browser: from now on, only open this website encrypted. A duration of one year is common. Only add includeSubDomains once really all subdomains have HTTPS.

Content-Security-Policy

The CSP defines where scripts, fonts and other content may be loaded from. It is the strongest protection against injected code, but must be tailored exactly to your website. We rate an existing CSP and point out obvious weaknesses. We deliberately do not provide ready-made code for it.

Framing protection and nosniff

X-Frame-Options or frame-ancestors prevent other sites from embedding your website invisibly and tricking visitors into clicks. X-Content-Type-Options: nosniff makes sure the browser does not treat files differently from what the server declares.

Referrer and Permissions Policy

The Referrer-Policy controls how much of the visited address other websites learn. The Permissions-Policy blocks camera, microphone or location for your page and embedded content. Both are useful, but missing them is not a security problem.

Version information and cookies

If the server names its version, that only helps attackers. For cookies the server sets directly, we check the protective attributes Secure, HttpOnly and SameSite. It turns red when a login or session cookie is sent without Secure.

Snippet for your server

If simple headers are missing, you get a ready-made block for .htaccess (Apache) and the same lines for nginx. It only contains what is missing on your site, and no CSP. Test it on a copy of the website before going live.

A badge for your website

With grade A or A+ and no red points, we offer you a badge to embed below the result, light or dark and in three sizes. The code is plain HTML without scripts, cookies or tracking. The badge links to this check with your domain, and a click runs the check again. That way it always shows the current state and cannot be faked. Whether you use it is entirely up to you.

Why security headers protect your website

Most attacks on small and medium-sized websites run automatically: programs search around the clock for sites with known weaknesses. Security headers do not fix a vulnerability in your CMS, but they make many attacks considerably harder, such as eavesdropping in public Wi-Fi, embedding in fraudulent pages or running injected code.

The good news: most headers take just a few lines in the server configuration and cost neither loading time nor money. Only the Content-Security-Policy takes more effort, because it has to know every embedded source, from the cookie banner to the map.

Many hosts do not set the headers by themselves. Settings are also easily lost after a move, a new theme or a caching plugin. So check your website again after every major change.

What good response headers look like

Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: default-src 'self'; script-src 'self' 'nonce-…'; object-src 'none'; frame-ancestors 'self'
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
Referrer-Policy: strict-origin-when-cross-origin
Permissions-Policy: camera=(), microphone=(), geolocation=()

The CSP above only illustrates the structure. Your own must include every service your website uses. The check generates the other lines as a snippet that matches your result.

Frequently asked questions about security headers

Why is there no ready-made code for the Content-Security-Policy?

Because a wrong CSP can bring your website to a halt: forms, videos, maps, payment services or the cookie banner then no longer load. A good CSP is built in steps, first in test mode (Report-Only), then with the collected reports. We are happy to do this for you.

Where does the snippet go in WordPress?

Into the .htaccess file in the root folder, above the line “# BEGIN WordPress”. If your website runs on nginx, the lines belong in the server configuration. With managed hosting there is often a separate setting in the host’s control panel.

Can the snippet break anything?

Rarely, but it is possible. X-Frame-Options, for example, prevents your page from being shown inside another frame, such as a page builder or a preview. HSTS cannot be withdrawn immediately once set. So test on a copy of the website first.

Why is my grade different from securityheaders.com?

We rate the same six headers on the same principle but weight some details differently, such as a CSP with unsafe-inline. We also check the HTTPS redirect, cookies and version information, which feed into the traffic light, not the grade.

The website responds with 403. What does that mean?

A firewall or bot protection probably rejected our request. The headers may then come from that protection page rather than your website, so we show them without a traffic light. In that case check the headers in your browser under developer tools, network.

Can I show the result on my website?

Yes, with grade A or A+ and no red points. Below the result you copy a short HTML code, for example for your footer. We store nothing for this. The badge links to this page with your domain, and a click runs a new check. If something is still missing, the check tells you what. Using the badge is voluntary.

Is my input stored?

We request your page once encrypted and once unencrypted and only read the response headers. We store the checked address and the result anonymously for statistical purposes. Your IP address is not stored. More in our privacy policy.

See all 35 tools

WordPress Security Check
Finds common weaknesses such as exposed usernames, outdated versions and public error logs.
Email Security Check
Checks SPF, DMARC, DKIM and MTA-STS of your domain: can someone forge e-mails in your name?
PHP Version Check
Checks whether your server reveals its PHP version and whether it still receives security updates.
CMS Detector
Shows which system a website runs on, whether the version still receives security updates and, for WordPress, which plugins are outdated or vulnerable.

Security you do not see

As a web agency in Vienna, we take care of the technical side of your website: security headers, Content-Security-Policy, updates and maintenance, so attacks do not stand a chance.

Get in touch