Security Headers Checker
Nivaronix's scanner checks the HTTP response headers your site actually sends and flags the ones that are missing, misconfigured, or deprecated. Run a scan below to see your own site's results, or read on to see exactly what this checker looks at and why each header matters.
What this checker looks at
This is a security misconfiguration check, not a vulnerability scanner or penetration test. It inspects the response headers returned by your site over HTTPS and evaluates six headers plus one deprecated header:
- Strict-Transport-Security — Tells browsers to only ever connect to your site over HTTPS, for a set period of time, without waiting for a redirect.
- Content-Security-Policy — Declares which sources a page is allowed to load scripts, styles, images and other resources from, restricting what injected content can do.
- X-Frame-Options — Controls whether your pages can be loaded inside an `<iframe>` on another site, which is the mechanism behind clickjacking.
- X-Content-Type-Options — Stops the browser from guessing a file's content type instead of trusting the server's declared Content-Type.
- Referrer-Policy — Controls how much of your page's URL is sent in the Referer header when a user clicks a link away from it.
- Permissions-Policy — Lets you switch off or restrict powerful browser APIs — camera, microphone, geolocation and more — for your own pages and any embedded content.
- X-XSS-Protection — flagged when present, because it is deprecated in every current major browser and should be removed rather than relied on.
How the checker works
When you submit a domain, the scanner requests your homepage once and reads the response it gets back. The header findings above come from the response headers, and for HSTS it accounts for browser HSTS preload-list status where that information is available. The same request's body is read too — up to 5 MB of it — so the wider scan can check meta and canonical tags and fingerprint the technologies in use; robots.txt and sitemap.xml are fetched as well. It does not follow redirects and it does not crawl beyond that page. Broken-link checking, which does follow links across a site, runs only on an asset you have verified and put under monitoring — never on a one-off scan from this page.
It does not attempt to exploit any finding, and it does not keep a copy of your page: we store the findings, not the HTML — though a finding quotes the specific header or tag it is about, so short excerpts are retained as evidence. A scan run here without an account is kept for seven days and then deleted, unless you choose to publish it as a shareable link, which stays reachable by anyone holding that link until you revoke it.
Each finding comes back with a severity — Medium for HSTS, Content-Security-Policy and X-Frame-Options; Low for X-Content-Type-Options, Referrer-Policy, Permissions-Policy and the deprecated X-XSS-Protection header — plus a plain-English explanation and the exact header line to add.
Why security headers matter
Security headers are a browser-enforced second layer of defense: they don't change your application code, but they tell every visitor's browser to refuse behavior that enables common attack classes — HTTP downgrade attacks, cross-site scripting, clickjacking, MIME-sniffing abuse, and referrer leakage. Most take a single line to add and have no functional downside once tested, which makes missing headers one of the highest-leverage, lowest-effort fixes a site can make.
Two are worth understanding first if you only fix a couple of things: HSTS, which stops SSL-stripping on repeat visits, and a Content-Security-Policy that blocks injected scripts from executing. Both close attack paths that no other header on this list addresses.
Header guides
Run the full scan
Security headers are one part of a site's overall security posture. Nivaronix's full website security scanner also checks SSL/TLS configuration, DNS, and other areas alongside headers.
A scan tells you where headers stand today. A misconfigured deploy or a dropped CSP directive next month won't show up until you check again. Nivaronix's platform monitors headers continuously and alerts you when something changes.