SSL Certificate Checker
★★★★★★★★★★5.0(0 ratings)👁 1❤ 0
Check any website's SSL/TLS certificate: validity, issuer, expiry date, days remaining, and SANs.
HTTP Header Checker
★★★★★★★★★★5.0(0 ratings)👁 2❤ 0
Inspect every HTTP response header: status code, content-type, cache, HSTS, CSP, X-Frame-Options, and more.
HTTP Header Checker
Headers fetched via CORS proxy. Proxies may strip some sensitive headers (Set-Cookie, Authorization).
Response Headers—
Security Headers Audit
About This Tool
Security Headers Audit
Checks for all six recommended security headers: HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy.
How It Works
Fetches the URL via a CORS proxy and reads all available response headers. Some headers may be stripped by the proxy for security reasons.
Frequently Asked Questions
What's a good security header score?
Aim for all 6 present on production. WordPress users can add them via .htaccess or a security plugin (Wordfence, Headers Security Advanced).
Why is Server header sometimes blank?
Well-configured servers strip Server header to avoid exposing exact software versions to potential attackers. This is a good security practice.
Why are some headers missing from the results?
CORS proxies may strip certain headers (Set-Cookie, Authorization, etc.) for security. For a complete audit, use curl from a server or browser DevTools Network tab.