OvuGuard

Security headers checker

See which protective HTTP headers your website sends and which are missing, plus how your cookies are set. Each gap comes with a plain-English explanation and the line to add.

Passive check only: we look at what your site already shows every visitor. Only check sites you own or are allowed to test.

The headers we look for

Strict-Transport-Security (HSTS)
Forces browsers to use HTTPS on every future visit, so nobody on public Wi-Fi can downgrade the connection.
Content-Security-Policy (CSP)
Lists where scripts, styles and frames may load from. It is the strongest defence against cross-site scripting (XSS).
X-Frame-Options / frame-ancestors
Stops other sites from embedding yours invisibly to trick clicks (clickjacking).
X-Content-Type-Options: nosniff
Stops browsers guessing file types, which can turn an uploaded file into a script.
Referrer-Policy
Controls how much of your page address is shared with other sites when visitors click a link.

Example for Nginx

add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-Frame-Options "DENY" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Content-Security-Policy "default-src 'self'; frame-ancestors 'none'" always;

Test your site above after each change. Create a free account to monitor headers over time.

Frequently asked questions

What are HTTP security headers?

They are short instructions your server sends with every page, telling the browser how to protect visitors, for example to always use HTTPS (HSTS) or to refuse to load your site inside another site's frame (X-Frame-Options).

Which security headers should every website have?

At minimum: Strict-Transport-Security, Content-Security-Policy (or at least frame-ancestors), X-Content-Type-Options: nosniff and Referrer-Policy. X-Frame-Options covers older browsers.

How do I add security headers?

Add them in your web server (Nginx add_header, Apache Header set, Caddy header), your CDN such as Cloudflare, or your framework's middleware. Test with this page after each change.

Can a Content-Security-Policy break my site?

Yes, a strict one can block scripts you rely on. Start with Content-Security-Policy-Report-Only, watch for problems, then enforce it.

More free tools