Security Headers Checker
Nivaronix's scanner checks the HTTP response headers your site actually sends and flags the ones that are missing, misconfigured, or deprecated. Run a scan below to see your own site's results, or read on to see exactly what this checker looks at and why each header matters.
What this checker looks at
This is a security misconfiguration check, not a vulnerability scanner or penetration test. It inspects the response headers returned by your site over HTTPS and evaluates six headers plus one deprecated header:
- Strict-Transport-Security — Tells browsers to only ever connect to your site over HTTPS, for a set period of time, without waiting for a redirect.
- Content-Security-Policy — Declares which sources a page is allowed to load scripts, styles, images and other resources from, restricting what injected content can do.
- X-Frame-Options — Controls whether your pages can be loaded inside an `<iframe>` on another site, which is the mechanism behind clickjacking.
- X-Content-Type-Options — Stops the browser from guessing a file's content type instead of trusting the server's declared Content-Type.
- Referrer-Policy — Controls how much of your page's URL is sent in the Referer header when a user clicks a link away from it.
- Permissions-Policy — Lets you switch off or restrict powerful browser APIs — camera, microphone, geolocation and more — for your own pages and any embedded content.
- X-XSS-Protection — flagged when present, because it is deprecated in every current major browser and should be removed rather than relied on.
How the checker works
When you submit a domain, the scanner makes a request to your site and reads the response headers it gets back. For each of the headers above, it records whether the header is present, and for HSTS it accounts for browser HSTS preload-list status where that information is available. It does not crawl your site, does not attempt to exploit any finding, and does not store a copy of your page content — only the header evidence needed to explain the result.
Each finding comes back with a severity — Medium for HSTS, Content-Security-Policy and X-Frame-Options; Low for X-Content-Type-Options, Referrer-Policy, Permissions-Policy and the deprecated X-XSS-Protection header — plus a plain-English explanation and the exact header line to add.
Why security headers matter
Security headers are a browser-enforced second layer of defense: they don't change your application code, but they tell every visitor's browser to refuse behavior that enables common attack classes — HTTP downgrade attacks, cross-site scripting, clickjacking, MIME-sniffing abuse, and referrer leakage. Most take a single line to add and have no functional downside once tested, which makes missing headers one of the highest-leverage, lowest-effort fixes a site can make.
Two are worth understanding first if you only fix a couple of things: HSTS, which stops SSL-stripping on repeat visits, and a Content-Security-Policy that blocks injected scripts from executing. Both close attack paths that no other header on this list addresses.
Header guides
Run the full scan
Security headers are one part of a site's overall security posture. Nivaronix's full website security scanner also checks SSL/TLS configuration, DNS, and other areas alongside headers.