Security Tools
Security Headers Checker
Scan a website's HTTP response for recommended security headers and get a score out of 100.
Enter a domain to scan its security headers and get a score out of 100.
JustChecker monitors your security headers continuously and alerts you if anything regresses.
Frequently Asked Questions
It combines the presence and correct configuration of every major browser-security-relevant header (HSTS, CSP, X-Frame-Options, and others) into a single number - a higher score means more of the recommended protections are actually in place.
Security headers are defensive measures against attacks that don't break normal functionality (clickjacking, cross-site scripting, MIME-sniffing) - a site can appear to "work fine" while still being exposed to attacks these headers specifically prevent.
HSTS (forcing HTTPS) and a basic Content-Security-Policy tend to provide the broadest protection for the effort involved - though the ideal priority depends on your specific site's risk profile.
A misconfigured Content-Security-Policy in particular can block legitimate scripts/styles from loading if not carefully scoped - test changes on a staging environment first, and expect CSP to need iteration rather than a single perfect configuration.
Most are set via web server configuration (Nginx, Apache), a reverse proxy/CDN, or application-level middleware - none of them are DNS records or anything configured through your domain registrar.
No - these headers address a specific category of browser-enforced protections; overall security also depends on server hardening, application code, dependency management, and many factors this specific check doesn't evaluate.