Enter a URL and we'll check the response for the HTTP security headers that actually matter -- HSTS, CSP, clickjacking protection, and more.
We fetch the URL you enter from our servers to read its response headers, so we can't check anything on your own private network. Nothing you enter is stored.
Not sure what a header does? Read our guide to each one.