Website security headers check.
Enter a web address and we read the headers the server sends with the page. They tell a browser what to refuse, and most are one line of server configuration.
Free. No sign-up.
What it checks.
Encryption
- Whether the page is on HTTPS
- Whether browsers are told to use HTTPS every time, and for how long
What may load
- A content security policy, and whether it limits scripts
- Whether other sites can show the page inside a frame
- Whether browsers are told not to guess file types
What leaves
- What other sites are told about where a visitor came from
- Whether cookies can travel unencrypted or be read by scripts
- Which device features the page may use
What is given away
- Software names and version numbers in the headers
What it cannot tell you.
- It reads the headers of one page. Other pages on the same site, a sign-in page above all, can send different ones.
- Headers reduce the damage a flaw can do. They do not find flaws, and a site with every header can still have them.
- It does not test the policy against the page, so it cannot say whether a strict policy would break something.
Further reading
Related
- Vulnerability Assessment Scans of your network, devices, cloud and websites for known weaknesses, with a fix list in order of risk.
- Firewall & Network Security Firewalls, network segmentation and secure remote access, with web application, DDoS and bot protection.
- Websites Design, development, e-commerce, hosting and maintenance for sites that load fast.
- Website health check Speed, security and SEO basics for any web page, checked in a few seconds.
- Email domain check SPF, DKIM and DMARC for your domain: can somebody else send email in your name?
- Domain and certificate expiry check When the certificate runs out and when the domain is due for renewal, before either takes the site down.
- Essential Eight assessment Twenty-four statements, about five minutes, and an estimated maturity level for each strategy.
Tell us what needs sorting.
Book a call or send an email. We reply within one business day.