How secure is your website? Find out in 30 seconds.
Enter your address and we'll check the five security headers every serious website should send, then grade the result and tell you exactly what to fix.
- ›Resolving address and connecting
- ›Fetching homepage response headers
- ›Checking Strict-Transport-Security
- ›Checking Content-Security-Policy
- ›Checking framing, MIME and referrer headers
- ›Grading and preparing your report
A grade, and the exact fix for every gap.
No jargon dump. Each missing header comes with what it protects against, how risky its absence is, and the line your developer needs to add.
- A security grade from A+ to D for your homepage
- Each header marked present or missing, with a risk level
- Copy-paste configuration to fix what's missing
- Which GDPR and DPDP Act safeguards each one supports
example-store.in
3 of 5 headers present · 2 high-risk gaps
The five security headers we test
HTTP security headers are instructions your server sends with every page. They cost nothing to add, and missing ones are among the most common findings in real security audits.
Content-Security-Policy
Limits which scripts can run on your pages, the main defence against cross-site scripting (XSS).
GDPR Art. 32 · DPDP reasonable safeguardsStrict-Transport-Security
Tells browsers to always use HTTPS, so attackers on public Wi-Fi can't downgrade the connection.
GDPR Art. 32 · PCI DSSX-Frame-Options
Stops other sites loading yours in a hidden frame to trick visitors into clicking (clickjacking).
OWASP recommendationX-Content-Type-Options
Prevents browsers guessing file types, which attackers abuse to run disguised files.
OWASP recommendationReferrer-Policy
Controls how much of your URLs leak to other sites when visitors click a link.
GDPR data minimisationWant to know your financial risk?
Our breach cost calculator estimates what an incident could cost a business like yours, using IBM, Verizon and CERT-In data.
Open the calculator →What a free scan can and can't tell you
Headers are a quick signal of how carefully a site is configured. They are not proof that it is secure, and we'd rather tell you that upfront.
This free scan checks
- Five security headers on your homepage
- Whether HTTPS is enforced through HSTS
- Basic protection against clickjacking and XSS
- A grade you can re-check after fixes
A full security audit also finds
- Login, password-reset and session flaws
- Customers able to see each other's data
- Outdated plugins, exposed admin panels and backups
- DPDP Act and GDPR gaps, with a report and re-test
Questions about the security check
What does this free website security check test?
It checks whether your homepage sends five important HTTP security headers: Content-Security-Policy, Strict-Transport-Security, X-Frame-Options, X-Content-Type-Options and Referrer-Policy. You get a grade and a plain-English fix for each missing header.
Is a header scan the same as a security audit?
No. Headers are a quick, useful signal of how carefully a site is configured, but they cannot find vulnerabilities in your login, checkout or admin areas. For that you need a manual security audit, which tests how your site behaves under attack.
Is it safe to scan my website?
Yes. The scan makes one normal request to your homepage, exactly like a visitor's browser, and reads the response headers. It does not log in, submit forms or try to attack anything.
How do I fix missing security headers?
Most can be added in a few lines of your web server or hosting configuration, such as .htaccess on Apache or a Cloudflare rule. Your report shows the exact header to add, and our team can configure them for you.
Why do you ask for my email?
So we can send you a copy of the report and follow up if you want help fixing anything. We do not add you to a mailing list or share your details.