Header presence
Whether HSTS, CSP, framing controls, nosniff, Referrer-Policy, Permissions-Policy and related headers appear on the live response.
Security headers checker
Free security headers checker
Paste a domain to run a PatchPings security scan. The headers category grades CSP, HSTS, framing controls and related policies — then we email the full breakdown when you ask.
Enter the public hostname visitors use. The scan grades live HTTP security headers with your other security checks.
example.com
PreviewA
92/100
Website audit score
Security HeadersPass
Website ReachabilityPass
TLSWarn
↞ Enter your URL to start the audit
Headers check
What this checker covers
HTTP security headers are graded in one PatchPings security scan — the same scan used on the homepage.
Policy strength
Whether values look intentional — for example a usable HSTS max-age, framing blocked, and CSP that is more than an empty shell.
Same full scan
Headers are graded inside the same PatchPings security scan used on the homepage, alongside TLS, DNS health and redirects.
Prefer the full scan catalog on /scans. Checking TLS? Use the SSL certificate checker. Email authentication sits on the DMARC checker.
FAQ
FAQ
Straight answers about this security headers checker.
What does a security headers checker check?
The security headers category in a PatchPings security scan grades live HTTP response headers such as HSTS, CSP, framing controls and related policies — the same four-type scan used on the homepage.
Is this security headers checker free?
Yes. Paste a domain and run the scan from this page at no charge. The Free plan covers 1 site and 5 audit reports per month with PatchPings-branded PDF reports.
Do I need an account?
Not to get started. Guest mode lets you try a few scans with no sign-up. Sign in with Google when you want the Free plan limits (1 site, 5 audits/month) and saved history.
Is this different from the homepage security scan?
No. This page runs the same PatchPings security scan; the headers category surfaces HTTP security header findings in the live preview.
Does PatchPings offer a separate headers API?
No. This page runs the same security scan as the homepage — there is no separate headers-only API.
Will I get an email report?
Yes. When you ask for it, PatchPings emails the full scan breakdown after the live preview.
