Security Header Checker

Check the security headers of any public website: HSTS, Content-Security-Policy, X-Content-Type-Options, X-Frame-Options, Referrer-Policy and Permissions-Policy. The check runs through TinyExe so it works for any public site.

Website URL

Example

Enter https://example.com and see which security headers are present or missing, with a plain explanation of each.

How to use it

Enter a public website URL.
Press Check headers.
Read the present and missing headers with explanations.

Frequently asked questions

Which headers are checked?

Strict-Transport-Security, Content-Security-Policy, X-Content-Type-Options, X-Frame-Options, Referrer-Policy and Permissions-Policy.

Is a missing header a vulnerability?

Not by itself. Headers are defence in depth; a missing header is a hardening gap, not proof of an exploitable flaw.

Is the checked URL stored?

No. The URL is fetched live for the check and is not logged.

Embed this tool

Copy the code below to show this tool on your own website, free, with TinyExe branding and a link back.

Size

<iframe src="https://tinyexe.com/embed/security-header-checker/" width="100%" height="600" style="border:0;max-width:100%;" loading="lazy" title="Security Header Checker - TinyExe"></iframe>
<script>
(function(){
var origin = "https:\/\/tinyexe.com";
var slug = "security-header-checker";
var src = "https:\/\/tinyexe.com\/embed\/security-header-checker\/";
window.addEventListener("message", function(e){
if (e.origin !== origin) return;
var d = e.data;
if (!d || d.type !== "tinyexe-resize" || d.slug !== slug) return;
var frames = document.querySelectorAll('iframe[src="' + src + '"]');
for (var i = 0; i < frames.length; i++) { frames[i].style.height = d.height + "px"; }
});
})();
</script>