DomainDNSCheck

HTTP & Security Headers Checker

Enter a hostname to see the response headers its HTTPS home page returns, along with a review of the headers browsers use to harden a site.

  • Web & SSL
  • Live check
  • Free, no sign-up
  • Results are not published

For example example.com — URLs and email addresses are accepted too.

At a glance

What it checks
View a site's response headers and review HSTS, CSP, framing, referrer policy and cookie attributes.
Data source
Response headers from an HTTPS request to the site.
Freshness
Live check; results are cached for up to 5 minutes
Limits
Security headers are defence-in-depth signals, not a vulnerability assessment. Methodology
Cost
Free, no account needed

Understanding the result

What is reviewed

The tool requests the home page over HTTPS (and HTTP for comparison), follows redirects and records the headers of the final response. It lists every header received and evaluates the common hardening headers when the final page is served over HTTPS:

  • Strict-Transport-Security (HSTS): tells browsers to use HTTPS only. A max-age of at least 180 days is a PASS; shorter values or a missing header are a WARNING. The result notes whether includeSubDomains is set.
  • Content-Security-Policy (CSP): restricts where scripts and other resources may load from. Present is a PASS, report-only or a policy that allows unsafe-inline or unsafe-eval is INFO, and missing is a WARNING.
  • X-Content-Type-Options: nosniff prevents browsers from guessing content types.
  • Framing protection: X-Frame-Options or a CSP frame-ancestors directive, which defends against clickjacking.
  • Referrer-Policy and Permissions-Policy: PASS when present, INFO when absent.

Extra observations

Two further findings are informational. If the Server header contains a version number, or an X-Powered-By header is present, the tool notes the software disclosure; hiding versions does not fix vulnerabilities, but it gives automated scanners less to go on. If the response sets cookies, each one is checked for the Secure, HttpOnly and SameSite attributes, and the number that lack at least one is reported. Some cookies legitimately need to be readable by scripts, so review these case by case.

Adding the headers

Headers can be set in the web server, the application or a CDN. A reasonable starting point for many sites is:

Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
Referrer-Policy: strict-origin-when-cross-origin
Content-Security-Policy: frame-ancestors 'self'

Roll out HSTS carefully: once browsers see it, they will refuse plain HTTP for the whole max-age, so make sure every subdomain works over HTTPS before adding includeSubDomains. Build a full CSP in report-only mode first, then enforce it once reports are clean.

What these results mean

Security headers are defense-in-depth signals, not a vulnerability assessment. A page with every header set can still have security flaws, and a page missing some headers is not necessarily exposed. The tool reads headers from the home page only and uses the DomainDNSCheckBot user agent, so other pages or browser sessions may receive different headers. For the underlying HTTPS setup, see the HTTP Status & HTTPS Checker and the SSL Checker.

Frequently asked questions

Why are no security findings shown for my site?

Header findings are only evaluated when the final response is served over HTTPS. If HTTPS is unavailable or the site redirects to an HTTP page, only the raw headers are listed.

Is X-XSS-Protection still needed?

No. Modern browsers have removed the filter it controlled, so the header has no effect. A Content-Security-Policy is the current way to reduce cross-site scripting risk.

Should I use X-Frame-Options or frame-ancestors?

The CSP frame-ancestors directive is the modern and more flexible option. Many sites send both for compatibility with older clients, and the tool accepts either.

What is HSTS preloading?

Browsers ship with a built-in list of domains that must always use HTTPS. Getting onto that list requires a long HSTS max-age, includeSubDomains and the preload directive, and removal is slow, so only apply once you are certain.