Enter a public website hostname to see whether five common browser-facing security headers are returned on its effective HTTPS page. The result is immediate, passive and requires no signup.
Check the rest of your public website security signals
This utility checks one part of the picture. ThreatScout's broader free scan also reviews HTTPS, security headers, DNS and email-protection signals.
ScoutLab returns only the small header set it can interpret consistently as part of its existing website-security checks.
Strict-Transport-Security (HSTS) — instructs supporting browsers to keep using HTTPS.
Content-Security-Policy (CSP) — controls which content sources a browser may load.
X-Frame-Options — limits framing and helps reduce clickjacking risk.
X-Content-Type-Options — the nosniff control that stops MIME-type guessing.
Referrer-Policy — controls how much referring URL information the browser sends onward.
How to interpret a missing header
A missing header is an observation, not proof of compromise. Some sites use a modern CSP directive instead of an older header, and the correct configuration depends on how the site is built.
Use the linked security headers guide to understand each control before making changes. Content-Security-Policy in particular should be tested carefully because an overly restrictive policy can break legitimate site functionality.
Why a standalone header check is useful
Security headers are externally visible and can change when hosting, CDN, reverse-proxy or application settings change. A quick checker gives developers and business owners a repeatable way to confirm what browsers are receiving right now.
For a broader view, ScoutLab's free website security scan checks headers together with HTTPS, DNS and email-authentication signals.
It reads selected HTTP response headers returned by a public website and shows which browser-facing security controls are present. ScoutLab checks HSTS, CSP, X-Frame-Options, X-Content-Type-Options and Referrer-Policy.
Are security headers enough to secure a website?
No. They reduce specific browser-side risks but do not patch software, secure administrator accounts, remove malware or replace vulnerability assessment and penetration testing where those are required.
Does this tool make changes to my website?
No. It is a passive external check. It requests the public HTTPS page and reports a bounded set of response-header and certificate facts; it does not exploit, modify or log in to the target.
