Nyrolo
Free tool

Free Security Headers Checker

Enter a page address and Nyrolo loads it once and reads the HTTP response headers the server sends back: HTTPS, HSTS, Content-Security-Policy, clickjacking protection, X-Content-Type-Options, Referrer-Policy and Permissions-Policy.

Free, no sign-up. We load the page once from our server as NyroloBot and show what we found. Only check sites you own or manage.

What this tool checks

HTTPS

Does the page load over HTTPS after any redirects?

Strict-Transport-Security (HSTS)

Does the site tell browsers to always use HTTPS, and for how long?

Content-Security-Policy

Is a policy set that limits which scripts and resources can run on the page?

Clickjacking protection

Is X-Frame-Options or CSP frame-ancestors set, so other sites cannot frame the page?

X-Content-Type-Options, Referrer-Policy, Permissions-Policy

Three small headers that tighten how browsers treat your pages.

How to use it

  1. Type the page address, for example yourclient.com.
  2. Press Scan Headers. We request the page once and read the headers that come back.
  3. Add the missing headers in your host, server or CDN settings, then scan again.

What it cannot tell you

  • We check which headers are present. We do not test whether a Content-Security-Policy is strong enough, and a passing result is not a full security audit.
  • We do not check the certificate itself, only that the page loads over HTTPS.
  • Some CDNs add different headers to different pages, so the result applies to the page you entered.

Frequently asked questions

What is HSTS?

HTTP Strict Transport Security is a header that tells browsers to always connect to your site over HTTPS. Once a browser has seen it, it will not try plain HTTP for the length of time the header sets.

Is HTTPS enough on its own?

HTTPS encrypts traffic, but headers such as HSTS, a Content-Security-Policy and clickjacking protection add further protection and are cheap to add on most hosts.

Do I need a Content-Security-Policy on a small client site?

It is good practice, but a badly written policy can break a site. Many agencies start with the simpler headers and add a policy carefully, often in report-only mode first.

How do I add these headers?

Where you add them depends on your host. Nginx, Apache, Cloudflare, Netlify, Vercel and others each have their own settings. Our guide shows examples.

Keep reading