Free security headers check
Grade your site's security headers in 10 seconds.
- 0Fail
- 0Warn
- 0Pass
| Result | Check | What we found | How to fix it |
|---|
Copy-paste fixes for your stack
Only the headers this check flagged. Pick where your site is hosted, paste, deploy, then run the check again.
Nothing to add: every header this check looks for is already set correctly.
About the CSP line: it's a Report-Only starting point, so it won't block anything yet. Watch the browser console for a week, add the script and image hosts you really use, then rename it to Content-Security-Policy.
The full audit finds the rest.
A passive audit of a site you own: TLS, headers on up to 20 pages, cookies, exposed files, software versions against public CVE databases and email DNS, in a plain-English PDF with a prioritized fix list. Delivered in 48 hours after you verify ownership.
Email me this report
Get these results and the fix list in your inbox, so you can forward them to whoever runs your site. We reply by hand within one business day.
What the headers check looks at
Eleven checks, scored into an A to F grade. Every failed check comes with a plain-English reason and a fix you can paste.
Security headers
- Strict-Transport-Security (HSTS)
- Content-Security-Policy
- X-Frame-Options or CSP frame-ancestors
- X-Content-Type-Options
- Referrer-Policy
- Permissions-Policy
Leaks and cookies
- Server, X-Powered-By and other headers that reveal software versions
- Secure, HttpOnly and SameSite on every cookie the page sets
- HTTPS in use, and http:// redirecting to it
Email spoofing
- SPF record for your domain
- DMARC record and its policy
- Looked up through Cloudflare's public 1.1.1.1 DNS
Strictly passive. One ordinary page load (following at most 3 redirects, the same as any visitor's browser) plus public DNS lookups. No scanning, no probing of other paths, no port checks, no attack attempts. Your logs will show one request identified as HolicAudit-FreeCheck/1.0. Results reflect only what that single page returned.
The full audit goes further on a site you own and verify: TLS configuration, up to 20 pages, exposed-file checks, software versions against public CVE databases, DKIM and certificate-log hostnames, with a prioritized fix list. Read a real sample report.
Also free: SEO quick check
Title, description, headings, canonical, sitemap, robots.txt, speed and more, with a fix for each.