Free tool · No signup

Website security headers check

HSTS, Content-Security-Policy, frame protection, cookie flags, exposed files and version leaks — checked from the outside, the way an attacker would look.

No signup · Results in ~10 seconds · Nothing stored except the shareable report

What we check and why

What we check

Security headers are instructions your server sends with every page that tell the browser how to protect visitors: always use HTTPS, which scripts may run, whether the page may be framed by another site. They cost nothing to add and close off whole classes of attack, yet many firm websites send none of them.

Strict-Transport-Security (HSTS) with a max-age of at least six months, includeSubDomains and preload.
Content-Security-Policy, including unsafe-inline, unsafe-eval and wildcard sources.
Clickjacking protection with X-Frame-Options or frame-ancestors.
X-Content-Type-Options, Referrer-Policy, Permissions-Policy and Cross-Origin-Opener-Policy.
Server and X-Powered-By headers that reveal software versions.
Secure, HttpOnly and SameSite flags on cookies, and mixed http:// content.
Publicly reachable files such as /.git/HEAD, /.env or backup configuration files, and /.well-known/security.txt.
CMS detection (WordPress, Joomla, Drupal, Wix, Squarespace, Shopify) and visible version numbers.

Why firms are a target

Law firms, notaries and accountants hold exactly the information attackers want: identity documents, financial data and confidential correspondence. The public website is rarely where that data lives, but a compromised site can be used to plant malware, run phishing pages under your domain or redirect clients to fraudulent payment details.

Under the GDPR you must implement appropriate technical measures to protect personal data, and professional bodies increasingly expect members to document basic cyber hygiene. A clean header report is an easy, visible part of that.

Fixing the findings

Most headers are added in one place: the web server configuration (nginx, Apache, Caddy), a CDN setting or a security plugin. Start with HSTS, X-Content-Type-Options, Referrer-Policy and frame protection, which rarely break anything. A Content-Security-Policy needs more care: deploy it first in report-only mode, review what it would block, then enforce it.

Exposed files and outdated CMS versions are urgent. Remove the files from the web root, update the CMS and its plugins, and hide version numbers from the HTML generator tag and response headers.

What an outside scan cannot see

This check looks only at what your server sends to any visitor. It cannot assess passwords, admin accounts, backups, plugin code or the security of the hosting environment. Treat a good result as evidence that the basics are in place, and keep regular updates, two-factor login for administrators and tested backups on your list as well.

Frequently asked questions

Is this scan safe for my website?

Yes. We send a small number of ordinary requests, the same a browser would, and probe a short list of well-known file paths with lightweight requests. We do not attempt logins, exploits or load testing.

What is HSTS and do I need it?

HTTP Strict Transport Security tells browsers to always use HTTPS for your domain, even if someone types http:// or follows an old link. Every site served over HTTPS should send it with a max-age of at least six months.

Will a Content-Security-Policy break my site?

It can if it is too strict, because it blocks scripts and styles that are not explicitly allowed. Start with Content-Security-Policy-Report-Only, check what would be blocked, adjust the policy and then switch it on.

Why does showing my WordPress version matter?

Publicly visible version numbers let automated scanners match your site against lists of known vulnerabilities. Hiding the number is not a fix by itself — keeping WordPress and its plugins updated is — but it removes an easy signal.

What is security.txt?

A small text file at /.well-known/security.txt (RFC 9116) that tells security researchers how to report a vulnerability to you. It is optional but signals that you take reports seriously.