Security Headers

Check HTTP security headers including HSTS, CSP and Referrer-Policy. Identify missing browser protection headers with My Secure Labs.

How to use Security Headers

Enter a public website hostname and run the security-header check after verification. Supports public IPv4 and native IPv6 addresses. For a domain, choose Auto IP, IPv4 or IPv6; Auto prefers IPv4 and uses IPv6 for IPv6-only domains. IPv6 connections require IPv6 connectivity at the test location.

Understanding the results

Review present and missing headers individually. Presence alone does not establish that a policy is configured safely. The score covers the listed response headers, not every application security control.

Is a missing security header always a vulnerability?

A missing header is a finding to review in the context of the application. Inspect the response and choose an appropriate policy; a header’s presence alone does not confirm that its value is secure.