Security Header Checker
Check the security headers of any public website: HSTS, Content-Security-Policy, X-Content-Type-Options, X-Frame-Options, Referrer-Policy and Permissions-Policy. The check runs through TinyExe so it works for any public site.
Check the security headers of any public website: HSTS, Content-Security-Policy, X-Content-Type-Options, X-Frame-Options, Referrer-Policy and Permissions-Policy. The check runs through TinyExe so it works for any public site.
Example
Enter https://example.com and see which security headers are present or missing, with a plain explanation of each.
How to use it
- Enter a public website URL.
- Press Check headers.
- Read the present and missing headers with explanations.
Frequently asked questions
Which headers are checked?
Strict-Transport-Security, Content-Security-Policy, X-Content-Type-Options, X-Frame-Options, Referrer-Policy and Permissions-Policy.
Is a missing header a vulnerability?
Not by itself. Headers are defence in depth; a missing header is a hardening gap, not proof of an exploitable flaw.
Is the checked URL stored?
No. The URL is fetched live for the check and is not logged.