Security headers checker: what does the page ask browsers to enforce?

Enter a page address. Beamfar reads the response headers of the page once and shows which security headers it sends and which are missing.

What the check reads

www.birch.example

HSTSmax-age=31536000Fine
Content-Security-Policydefault-src 'self'Fine
nosniffsentFine
Frame protectionnot sentLook at this
Referrer-Policyno-referrerFine

An example, made up. Your check shows the real readings of the address you enter.

What the check looks at

The same probes Beamfar uses to monitor a client site, run once, from this server.

Strict-Transport-Security: Tells browsers to use https only for the site, so a visitor cannot be moved to plain http on the way.
Content-Security-Policy: Lists where scripts, styles and frames may come from. It is the strongest protection against injected scripts.
X-Content-Type-Options: nosniff stops browsers from reading a file as another type than the server said.
X-Frame-Options or frame-ancestors: Stops other sites from showing the page inside a frame to trick clicks.
Referrer-Policy and Permissions-Policy: What the page tells other sites about where a visitor came from, and which browser features it may use.

How to read the result

Each reading gets one of the words of the free check, with its mark.

Fine means the page sends the main headers: Strict-Transport-Security, a Content-Security-Policy, nosniff, frame protection and a Referrer-Policy.
Look at this lists what is missing. A missing header is not a breach: it is a protection the site does not ask for.
Problem means the final page is served over plain http, where no header can protect it: anyone on the way can change the page and its headers.

How to add the missing headers

Where to set them: in the web server or CDN configuration (Nginx add_header, Apache Header set, a CDN’s response header rules) or by a security plugin of the CMS.
Strict-Transport-Security: start with max-age=86400, check every subdomain works on https, then raise it to a year.
Content-Security-Policy: start in report-only mode, collect what the site really loads, then enforce a policy that allows exactly that.
The quick ones: X-Content-Type-Options: nosniff, Referrer-Policy: strict-origin-when-cross-origin and X-Frame-Options: SAMEORIGIN rarely break anything.

What happens to the address you enter

One check, then nothing kept. Only public websites, only the standard web ports.

Nothing is stored: The address is used for this one check and then forgotten: no database row, no log line, no cookie, no link to share the result. Only rate-limit counters are kept: hashed counts per network range and overall, for at most two days, never an address of a site.
Only public websites: Addresses on private networks, loopback, link-local and cloud-metadata ranges are refused, and so are redirects to them. Only the standard web ports 80 and 443 are used. Each name is looked up once and the connection goes only to the address that passed. Checks are limited per network and overall, share the budget of the free site check, and need a short puzzle to be solved by your browser.

The site you check will see a few requests from Beamfar-probe in its logs, from this server. The Beamfar security scan of a monitored site reads these headers every day, together with scripts and frames from new hosts, hidden links and software on the list of exploited flaws.

Questions

Is this security headers checker free?

Yes. No account and no payment. It shares the rate limits of the free site check.

Does a missing header mean the site was hacked?

No. The headers ask browsers to block some attacks; a site without them is not compromised, it is less protected.

Does it grade the Content-Security-Policy?

It shows the policy as sent and says whether frame-ancestors is in it. It does not score how strict the policy is.

Which page are the headers read from?

The final page after redirects, as this server received it. Other pages of the site can send other headers.

Is the address I enter stored?

No. It is used for this one check only. Only hashed rate-limit counters are kept, for at most two days.

Guides that go with this page

Longer reads on the same ground, in plain words, each with its sources.

More free tools

One live check each, no account. The free site check runs all of them at once.

Watch a client site’s security from outside.

Beamfar reads every client site from outside each day and shows each possible problem with its evidence.

Start the 14-day trial All free tools

No card for the trial.