How to Check a Website's Security Headers for Free (3 Ways)
Security headers are short instructions your website sends with every page, telling browsers how to behave: always use HTTPS, do not let other sites frame this page, do not guess file types. Checking them takes a couple of minutes and no paid tool. Here are three free ways, and what the common headers mean.
Way 1: Your browser's developer tools
- Open the page in Chrome, Edge or Firefox and press F12 to open developer tools.
- Open the Network tab and reload the page.
- Click the first request in the list (the page itself) and look at Response Headers.
- Look for names such as strict-transport-security, content-security-policy, x-frame-options, x-content-type-options, referrer-policy and permissions-policy.
Way 2: One curl command
If you use a terminal, curl -I https://yoursite.com prints the response headers. Add -L to follow redirects. Compare the output with the list below.
Way 3: A free online checker
Nyrolo's free security headers checker loads the page once, reads the response headers, and marks each important header as present, missing or worth a closer look, with a short explanation. It does not test whether a content security policy is strong enough, so treat it as a first check and not a security audit.
What the common headers do
- Strict-Transport-Security (HSTS): tells browsers to always use HTTPS for your site. A typical value is max-age=31536000; includeSubDomains. Think before adding preload, because it is hard to undo.
- Content-Security-Policy: limits which scripts, styles and other resources a page may load. Powerful, but a badly written policy can break a site, so many teams start in report-only mode.
- X-Frame-Options or CSP frame-ancestors: stops other sites from showing your page inside a frame, which protects against clickjacking.
- X-Content-Type-Options: nosniff: stops browsers from guessing file types.
- Referrer-Policy: controls how much of the page address is sent to other sites when someone clicks a link.
- Permissions-Policy: switches off browser features, such as camera or microphone, that the site does not use.
Where to add them
It depends on your hosting. On Nginx and Apache you add them in the server config. On Cloudflare you can use rules. Many hosts, including static hosts, let you set headers in a configuration file or dashboard. After changing anything, test again, and check the site still works.
Frequently asked questions
Which security header matters most?
For most small sites, HTTPS with HSTS is the first one to get right, followed by clickjacking protection and X-Content-Type-Options. A content security policy is valuable but needs more care.
Will missing headers get my site hacked?
Missing headers do not mean a site is broken into, but they remove protections that browsers can apply for you. They are cheap to add and worth doing.
Do security headers affect SEO?
Google has said HTTPS is a lightweight ranking signal. The other headers are not ranking factors, but they affect how safe the site is for visitors.
Keep reading
Check your own site in about 15 seconds
Nyrolo runs a bounded pre-launch audit and gives you a 0-100 score, a verdict and fix steps for WordPress, Webflow, Shopify and custom code.
Run Free Audit