What are security headers (and which you need)?
Security headers are small instructions your server sends with every page that tell the browser how to protect your visitors — cheap to add, and they close real attack classes.
What it is
They're HTTP response headers. The key ones: HSTS (force HTTPS), Content-Security-Policy (limit what scripts can load — stops most XSS), X-Content-Type-Options (no MIME sniffing), X-Frame-Options / frame-ancestors (block clickjacking), and Referrer-Policy.
Why it matters
Missing headers leave the door open to cross-site scripting, clickjacking and protocol downgrade attacks. They're also an easy, visible signal of a well-run site — and some are checked by security scanners and partners.
How to check
Enter your URL in the tool above. It grades your headers, lists which are present and missing, highlights risky settings (like a wildcard CORS policy), and gives a ready-to-paste config snippet.
How to fix
- Add HSTS once you're fully on HTTPS.
- Add a Content-Security-Policy — start in report-only mode, then enforce.
- Set X-Content-Type-Options: nosniff and a frame policy.
- Avoid
Access-Control-Allow-Origin: *on anything sensitive.