Question 1

What are HTTP security headers?

Accepted Answer

HTTP security headers are response headers that instruct browsers how to handle your site safely: Content-Security-Policy blocks XSS, Strict-Transport-Security enforces HTTPS, X-Frame-Options prevents clickjacking, and others control referrers, MIME sniffing, and permissions. They are a first line of defense for every website.

Question 2

Which headers does the free checker test?

Accepted Answer

The checker audits 9 essential headers: Content-Security-Policy, Strict-Transport-Security (HSTS), X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, Cross-Origin-Opener-Policy, Cross-Origin-Resource-Policy, and Cross-Origin-Embedder-Policy. Each is graded A–F with copy-paste fix snippets.

Question 3

Can a headers checker replace a full security scan?

Accepted Answer

No — headers are one layer. A site can have perfect headers and still be vulnerable via outdated software, exposed secrets, or email spoofing. Use the headers grade as a quick win, then run a full scan for TLS, DNS, email authentication, and CVE correlation.

Free security headers checker