What does this security header checker test?

It reads one public HTTP response after redirects and reports selected security headers and their actual values.

Does a present header prove that the site is secure?

No. A value can be incomplete or unsafe for a particular application. Testing and configuration review are still required.

Why is there no overall security score?

A single number mixes header presence with policy quality. SEOKit keeps the evidence separate so each decision can be reviewed.

FREE HTTP RESPONSE CHECK

Security headers checker for one public URL

Enter a URL to inspect the actual HTTP security headers returned after redirects. This security header checker separates core, informational and deprecated headers without treating presence as a full security audit.

OBSERVED RESPONSE

Security header check result

Group	Header	Status	Observed value

How to read this result: header presence is evidence from the server response, not proof of a safe policy. Review values in the application context before changing configuration.

METHOD

How the HTTP response security headers check works

This is a focused HTTP security header check, not a vulnerability scanner. Use it to check HTTP security headers after a release, CDN change or server configuration update.

Normalize the URL

Only public HTTP/HTTPS URLs on standard ports are allowed.

Fetch safely

Redirects are revalidated; cookies and credentials are not forwarded.

Report evidence

Each header shows its observed value or an explicit missing status.

WHAT IS CHECKED

Core, informational and deprecated headers

The core group covers CSP, HSTS, X-Content-Type-Options, X-Frame-Options, Referrer-Policy and Permissions-Policy. Cross-origin policies are reported separately, while X-XSS-Protection, Expect-CT and Feature-Policy are flagged as deprecated when sent.

LIMITS

A presence check is not a security audit

The tool does not attack the site, test browser behavior or prove that a CSP is safe. The phrase security HTTP headers often refers to the same response-header family, but correct policy depends on the application.

FAQ

HTTP security headers test FAQ

Is this an OWASP HTTP security headers scanner?

No. The checker uses the common response-header set and links to OWASP as a reference, but it is not an OWASP product and does not replace OWASP testing guidance.

How is this HTTP header security check different from Site Audit?

This page reports only security headers from one HTTP response. Site Audit adds indexability, metadata, page structure, Schema and other SEO signals.

Can the checker test a private or local URL?

No. Local, private and reserved addresses, embedded credentials and non-standard ports are blocked to protect the service.

Sources for reviewing a result: OWASP Secure Headers Project · MDN HTTP headers

NEXT STEP

Need the wider technical context?

Run Site Audit for indexability, meta tags, Schema, links and the other signals available for one URL.

Open Site Audit →