Security headers checker
We fetch the site once and inspect the response headers that control how browsers protect your visitors.
Every missing header comes with the exact line to add and what it defends against.
Headers are the cheapest security work available
They are configuration, not code. Most of them are one line in a web server config or a CDN rule, they cost nothing, and they are the first thing an assessor looks at because they are trivially verifiable from outside.
Start with HSTS, then Content Security Policy
HSTS is a single line with no realistic downside once your site is fully on HTTPS. A Content Security Policy is the one that takes effort — deploy it in report-only mode first, find what breaks, then enforce.
What headers do not do
They protect visitors’ browsers. They do nothing about an out-of-date CMS, a weak admin password, or a vulnerable plugin. A perfect header score on a two-years-out-of-date WordPress install is a false sense of security.
Common questions
What max-age should HSTS use?
One year — max-age=31536000 — with includeSubDomains. Browsers will not accept a site into the preload list below 180 days. Start shorter if you are nervous, then raise it.
Will a Content Security Policy break my site?
A badly written one will, which is exactly why Content-Security-Policy-Report-Only exists. Run it in report-only for a fortnight, read what it would have blocked, then enforce.
Do these headers help with compliance?
They are commonly checked in cyber-insurance questionnaires and vendor security reviews, and they are visible from outside, so they are among the first things a reviewer verifies.
Track headers across every client site
Marchpost watches every domain you manage on a schedule, alerts you when something changes, and produces the branded report you hand to the client. $99/month, everything included.
Other free tools