HTTP Security Headers Checker

Analyze your web server response headers. Grade your cryptographic posture, evaluate CSP directives, and generate copy-paste production configurations.

Scan only websites and APIs that you own or are authorized to test. Results are non-destructive.

Header Analysis Engine v2.4100% Non-Destructive

$ curl -sI https://example.com | wesecurex-headers

[PASS] Strict-Transport-Security: max-age=63072000; includeSubDomains; preload

[PASS] X-Content-Type-Options: nosniff

[PASS] X-Frame-Options: DENY

[PASS] Content-Security-Policy: default-src 'self'; script-src 'self'

[PASS] Referrer-Policy: strict-origin-when-cross-origin

[WARN] Permissions-Policy header missing - recommended for hardware privacy

[GRADE] Security Posture: Grade A (Score: 92/100)

Essential HTTP Security Headers Reference

Strict-Transport-Security (HSTS)Mandatory
max-age=63072000; includeSubDomains; preload

Forces browsers to exclusively establish encrypted HTTPS connections, preventing SSL stripping.

Content-Security-Policy (CSP)Mandatory
default-src 'self'; script-src 'self' 'nonce-random123'

Restricts script, stylesheet, and media execution origins, neutralizing Cross-Site Scripting (XSS).

X-Frame-OptionsMandatory
DENY

Prevents third-party domains from embedding your application in iframes, stopping clickjacking.

X-Content-Type-OptionsMandatory
nosniff

Stops browsers from MIME-sniffing response content types, preventing script injection via disguised uploads.

Referrer-PolicyRecommended
strict-origin-when-cross-origin

Protects user privacy by stripping sensitive URL query paths when navigating across external origins.

Permissions-PolicyRecommended
camera=(), microphone=(), geolocation=()

Explicitly disables browser hardware access (webcam, microphone) for unauthorized third-party scripts.

Production Configuration Snippets

Nginx Configuration (/etc/nginx/conf.d/security-headers.conf)
# Grade A+ Security Headers for Nginx
add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-Frame-Options "DENY" always;
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self';" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;
Architecture Guide

Want to master CSP Level 3?

Read our complete architectural guide to Content Security Policy.

Read Headers Guide
Engineering Blog

Complete Website Security Guide

Protect your web assets from cyber threats with comprehensive perimeter hardening.

Read Blog Post
Need Automated Continuous Audits?

Upgrade from Single-Check to Automated DAST Vulnerability Scanner

Full-scale active fuzzing for OWASP Top 10, SQLi, XSS, SSRF & BOLA. Scale with automated schedules, Slack alerts, 150+ monthly credits, and compliance PDF exports on our paid tiers.

Headless Chromium SPA crawlerActive OWASP Top 10 fuzzingAutomated SQLi & XSS verification
Explore Paid Plans (from $9/mo)Launch Free Instant DAST Scan

Frequently Asked Questions

What are HTTP security headers and why do they matter?

HTTP security headers are response directives sent by your server that instruct modern web browsers to enforce strict security behaviors. They protect users against clickjacking, cross-site scripting (XSS), MIME-sniffing vulnerabilities, and SSL-stripping man-in-the-middle attacks.

What is HSTS preloading and how do I qualify?

HSTS (HTTP Strict Transport Security) preloading bakes your domain directly into the source code of Chrome, Firefox, Safari, and Edge. To qualify, your server must serve Strict-Transport-Security with max-age >= 31536000 (1 year), includeSubDomains, and the preload flag, with all HTTP requests redirecting to HTTPS.

Why is the X-XSS-Protection header considered deprecated?

The legacy X-XSS-Protection header has been deprecated by modern browsers because its reflective XSS filters introduced side-channel vulnerabilities and user tracking risks. Modern web standards mandate Content Security Policy (CSP) instead.

How can I test my security headers continuously in CI/CD?

You can integrate the WeSecureX CLI or GitHub Actions runner into your deployment pipeline to automatically fail builds if mandatory security headers are missing from staging or production environments.