What does a security headers checker do?
A security headers checker reads the HTTP response headers a website returns and reports which protective headers — such as HSTS, Content-Security-Policy, X-Frame-Options and X-Content-Type-Options — are present or missing. SiteGuard Monitor's checker shows your headers alongside SSL, DNS, email security and uptime in one explainable 0-100 risk score.
Missing HTTP security headers leave sites open to clickjacking, content sniffing and downgrade attacks — yet they're invisible in a browser. This free security headers checker shows exactly which protective headers a site sends and which gaps are worth closing.
Why security headers get overlooked
Headers don't change how a site looks, so they're easy to forget — especially after a redesign or platform migration. The result is sites that work fine but quietly miss protections against framing, MIME sniffing and protocol downgrade.
- No HSTS leaves users exposed to HTTPS downgrade
- A missing X-Frame-Options or CSP frame-ancestors allows clickjacking
- No X-Content-Type-Options permits MIME-type sniffing
Headers this tool checks
- Strict-Transport-Security (HSTS)
- Content-Security-Policy (CSP)
- X-Frame-Options and frame-ancestors
- X-Content-Type-Options and Referrer-Policy
Headers as part of the full risk score
Header coverage is one input into the bigger picture. This tool runs a complete free scan, so the headers appear next to the SSL certificate, DNS records, SPF and DMARC, and uptime — combined into one 0-100 risk score that shows where to focus first.
Keep headers in place after every deploy
Deployments and config changes silently drop headers all the time. Add a domain to SiteGuard Monitor and header coverage is tracked, so a regression triggers an alert and shows up in your branded monthly report.
- Ongoing monitoring of security-header coverage
- Alerts when protective headers disappear
- Header status included in client reports
Passive, read-only inspection
Checking headers means reading a normal HTTP response — nothing more. SiteGuard performs no payload injection, fuzzing or aggressive scanning; it simply records the headers your server already returns.