Free tools, Website checks
HTTP headers checker
Every response header a page sends, and a quick score for the six security headers that matter.
All response headers
| Header | Value |
|---|
This tool runs on the Holsha server. Files and addresses are processed on the spot and not stored.
Questions
Which security headers matter most?
Strict-Transport-Security (forces HTTPS), Content-Security-Policy (stops injected scripts), X-Content-Type-Options: nosniff and frame protection with X-Frame-Options or frame-ancestors. Referrer-Policy and Permissions-Policy are smaller wins that take a minute to add.
Can adding headers break my site?
Most can’t. Content-Security-Policy can, because it blocks scripts and styles from sources you didn’t list. Start with Content-Security-Policy-Report-Only to see what would be blocked, then switch it on.
Where do I add these headers?
In your server configuration (nginx add_header, Apache Header set in .htaccess), in your CDN settings such as Cloudflare Transform Rules, or with a security plugin on WordPress.
More website checks tools
- Is the website down?Check if a site is down for everyone or just for you.
- SSL checkerWho issued the certificate, which names it covers and when it expires.
- DNS lookupA, MX, TXT, NS records plus SPF, DMARC and DKIM checks.
- WHOIS lookupRegistrar, registration and expiry dates of a domain.
- Redirect checkerFollow every 301 and 302 hop to the final page.
- Page speed testGoogle Lighthouse scores, Core Web Vitals and what to fix first.