Security Headers Checker
Which security headers is my site missing?
Security headers are the instructions your server gives every visitor's browser about what it may load, frame, and leak - and a framework that ships none by default leaves all of them unsaid. This checker reads the headers your site actually sends, grades them, and links straight to a generator for the ones you are missing.
Headers this checker reads
Content-Security-Policy
The header that decides which scripts, styles, and connections a browser will honour. Absent, any injected script runs with your page's full authority.
Strict-Transport-Security
Checks for HSTS and its max-age, includeSubDomains, and preload directives. Also flags hosts on Cloudflare or Netlify serving without it.
X-Frame-Options and frame-ancestors
Whether another site can load yours in an iframe and trick a signed-in user into clicking something they cannot see.
Referrer-Policy and Permissions-Policy
Whether full URLs leak to third parties in the Referer header, and whether camera, microphone, and geolocation are switched off by default.
Version-disclosing headers
X-Powered-By and server banners that name your exact framework and version - free reconnaissance for anyone matching you against a CVE list.
Everything else on the same run
The scan also checks exposed keys, TLS, CORS, cookies, open endpoints, and database exposure. Missing headers rarely travel alone.
Read more →How the Security Headers Checker works
- Step 1
Paste your URL
The live URL is the only input. No repository access, no server config, no agent to install, and no Ubserve account.
- Step 2
We read the response your server sends
We request your page, follow safe redirects, and inspect every response header - checking each security header for presence and for whether its value is actually strong, since a CSP full of unsafe-inline is present and still weak.
- Step 3
You get the report, partially unlocked
You see the issue count, a letter grade, and up to two findings in full, free. The rest - including the highest-severity findings and the copy-paste fix prompts - unlocks with a one-time report unlock or a plan.
Frequently asked questions
How do I know which security headers I am missing?
Open DevTools, go to the Network tab, reload, click the first document request, and read the Response Headers panel. You are looking for Content-Security-Policy, Strict-Transport-Security, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy. Anything not listed is not being sent. This checker does that for you and also judges the values, because a header can be present and still permissive enough to be worthless.
What is a Content-Security-Policy?
A Content-Security-Policy is a header listing where a browser may load resources from - scripts, styles, images, fonts, and network connections - and it refuses anything not on that list. It is the difference between an injected script running with your page's full authority and being blocked before it executes. It is also the header most often missing, because it is the only one that can break a working site if written carelessly, so it tends to get postponed and then forgotten.
How does the checker work?
It runs the standard Ubserve public scan. We request your URL, follow safe redirects, and read the response headers, checking each security header for presence and for the strength of its value - max-age on HSTS, unsafe-inline in a CSP, a permissive frame policy. We also flag headers that disclose your framework and version. Everything is read from the same response your browser gets.
Is it free? Do I need to sign in?
The scan is free and you do not need an account to run it. You get the issue count, a letter grade, and up to two findings shown in full - location, evidence, and severity - at no cost. The rest of the report stays locked, including the highest-severity findings and the copy-paste fix prompts you can hand to your AI coding tool. Unlocking everything is a one-time payment for that report, or a plan if you want repeat scans and monitoring.
Does Ubserve see my server config or source code?
No. This scan only reads what your app already serves to the public: the HTML at your URL, the JavaScript bundles that page links to, HTTP response headers, TLS certificate details, and public DNS records. We never ask for a repository, a database password, a service-role key, or an app login, and we cannot see private source code or authenticated pages. When we find a secret in your bundle, we found it because your browser downloads it too - anyone viewing your site can read the same bytes.
Will adding these headers break my site?
Most of them will not. X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy are safe to add as-is on almost any site. Two need care: HSTS with preload is difficult to reverse, so only enable it once every subdomain is reliably HTTPS, and a strict Content-Security-Policy will block inline scripts and styles until you move them or adopt nonces. Our generator defaults to a CSP that permits inline code, with a strict mode you can switch on once you are ready.
What founders say
5.0 out of 5 - Ubserve, from 3 reviews
“Helped me find a critical database issue that would've done real damage. I recommend it for every founder.”
“Caught a critical CSP issue on my frontend within minutes. Don't ship without a scan.”
“The free scan took under 60 seconds to find real issues in my project.”
Other free tools
See all tools →CSP Generator
Builds a Content Security Policy and the rest of your security headers as copy-paste config for Next.js, Vercel, Netlify, or Cloudflare Pages.
Open tool →Website Vulnerability Scanner
The full public scan: bundles, headers, TLS, CORS, endpoints, DNS, and database exposure in a single pass.
Open tool →Exposed API Key Scanner
Downloads your deployed JavaScript and matches it against key patterns for 30+ providers, from Stripe to OpenAI to AWS.
Open tool →Keep reading
- Vulnerabilities we catchThe full list of what a public scan finds.
- Pre-deploy security checklist for vibe-coded appsThe last pass before you ship.
- How to secure a vibe-coded app before productionOrder of operations for a launch week.
- Broken access control in AI-built appsHeaders help, but they are not access control.
- SAST vs DAST for AI-built appsWhy a deployed response tells you more than the config file.
Run the Security Headers Checker
Paste your URL and see what your app is handing to the public. Free, no account, no repo access.