Free checker

Free security headers checker for your live site

Paste your live URL to see which recommended security headers your site sends and which ones are missing. It's passive: SniffPup loads your page like a normal browser and reads the response headers. It never logs in or sends attack payloads.

This runs SniffPup's normal free scan, so you get the whole report, not just this one check. Header results are listed as “Missing … recommended security headers”, “Cookies missing Secure / HttpOnly / SameSite flags” and “doesn't redirect to https://”. The free report lists every issue it finds with its severity and shows the full explanation and fix for the most serious one. Only scan sites you own or are authorized to test. What the scanner does and never does.

What this checks

Strict-Transport-Security (HSTS) on HTTPS sites, so browsers don't fall back to plain HTTP.
Content-Security-Policy: whether the header is present.
Clickjacking protection: X-Frame-Options, or a CSP frame-ancestors rule.
X-Content-Type-Options: nosniff.
Referrer-Policy.
Cookie flags: cookies set by the page without Secure (on HTTPS), HttpOnly or SameSite.
HTTPS redirect: whether http:// redirects to https://.

What it can't tell you

It reads the headers of the page you enter (after redirects), not every page or API route on your site.
It checks that a Content-Security-Policy exists, not how strict it is.
It doesn't check Permissions-Policy or other optional headers.
It can't see your server code, database rules or anything behind a login. No missing headers doesn't mean the site is secure.

Check it yourself

You can see your headers from a terminal. Use your published URL, not the editor preview:

curl -sI https://your-app.com

Look for the header names above in the output. Header names aren't case-sensitive.

How to add the basic headers

Most hosts let you set headers in a config file. Start with the four below; they rarely break anything. Add a Content-Security-Policy separately and test it on a preview first, because a strict policy can block scripts your app needs.

Vercel (vercel.json):

{
  "headers": [
    {
      "source": "/(.*)",
      "headers": [
        { "key": "Strict-Transport-Security", "value": "max-age=63072000; includeSubDomains" },
        { "key": "X-Content-Type-Options", "value": "nosniff" },
        { "key": "X-Frame-Options", "value": "DENY" },
        { "key": "Referrer-Policy", "value": "strict-origin-when-cross-origin" }
      ]
    }
  ]
}

Netlify (a _headers file in your publish folder):

/*
  Strict-Transport-Security: max-age=63072000; includeSubDomains
  X-Content-Type-Options: nosniff
  X-Frame-Options: DENY
  Referrer-Policy: strict-origin-when-cross-origin

Only add includeSubDomains if every subdomain you use serves HTTPS. After you deploy, scan again to confirm. See also how to find exposed API keys on your website and how the Sniff score works.

Questions

Which security headers does this checker look for?

Strict-Transport-Security (on HTTPS sites), Content-Security-Policy, X-Frame-Options or a CSP frame-ancestors rule, X-Content-Type-Options: nosniff and Referrer-Policy. It also checks cookies set by the page for the Secure, HttpOnly and SameSite flags, and whether the http:// version of your site redirects to https://.

Does it grade my Content-Security-Policy?

No. It checks whether a Content-Security-Policy header is present, and whether frame-ancestors is set when X-Frame-Options is missing. It does not judge how strict your policy is.

If no headers are missing, is my site secure?

No. Headers are one layer. A passive scan checks what any visitor can see on your live site; it is not a penetration test or a code review, and it can't see your database rules or server code.

Can I check a site I don't own?

Please don't. The scan form asks you to confirm you own the site or are authorized to test it, and scans are rate limited per visitor and per site. Site owners can opt out by emailing abuse@sniffpup.com.

All free checkers