Free security headers checker · Instant · No signup

Security Headers Checker

Grade your site’s HTTP security headers. Domain Doctor checks HSTS, CSP, X-Content-Type-Options, X-Frame-Options and more, with fixes for each gap.

19 checks per scan Results in seconds Free, no signup

The tool

What the Security Headers Checker checks

HTTP security headers are the browser-side defences that stop clickjacking, MIME sniffing, protocol downgrade and cross-site scripting. They cost nothing to add and dramatically raise the bar for attackers.

Domain Doctor inspects your live response headers for HSTS (with includeSubDomains/preload), Content-Security-Policy, X-Content-Type-Options, X-Frame-Options / frame-ancestors, Referrer-Policy and Permissions-Policy, then grades your configuration and shows the exact header to add for each gap.

How it works

Check your domain in three steps

1Enter your domainType any domain into the box above and start the free scan. No signup, no software.

2We inspect it liveDomain Doctor reads your live HTTP response headers, in real time from our servers.

3Get a clear verdictYou get a plain-language result, the exact records we found, and a concrete fix if anything is wrong.

What to watch for

Common Security Headers Checker problems

Missing Strict-Transport-Security (HSTS)
No Content-Security-Policy, leaving XSS unmitigated
Missing X-Content-Type-Options: nosniff
No clickjacking protection (X-Frame-Options / frame-ancestors)
Missing Referrer-Policy or Permissions-Policy

VASTROX Managed Hosting

A-grade security headers, set up for you

VASTROX managed hosting ships HSTS, CSP and the full header set tuned to your site, with no misconfiguration risk.

HSTS, CSP and clickjacking protection
Headers tuned to your assets so nothing breaks
Continuously monitored

Harden my site Explore VASTROX Hosting

Hosting, VPS, business email and game servers. Free migration. Real support.

Questions

Frequently asked

Which security headers matter most?

HSTS, Content-Security-Policy, X-Content-Type-Options and a clickjacking protection (X-Frame-Options or CSP frame-ancestors) are the highest-impact. Referrer-Policy and Permissions-Policy round it out.

Will adding headers break my site?

HSTS and nosniff are safe. Content-Security-Policy needs care, start in report-only mode, then enforce once you have tuned it to your assets.