Enter a public website hostname to see whether five common browser-facing security headers are returned on its effective HTTPS page. The result is immediate, passive and requires no signup.
Check the rest of your public website security signals
This utility checks one part of the picture. ThreatScout's broader free scan also reviews HTTPS, security headers, DNS and email-protection signals.
ScoutLab returns only the small header set it can interpret consistently as part of its existing website-security checks.
Strict-Transport-Security (HSTS) — instructs supporting browsers to keep using HTTPS.
Content-Security-Policy (CSP) — controls which content sources a browser may load.
X-Frame-Options — limits framing and helps reduce clickjacking risk.
X-Content-Type-Options — the nosniff control that stops MIME-type guessing.
Referrer-Policy — controls how much referring URL information the browser sends onward.
How to interpret a missing header
A missing header is an observation, not proof of compromise. Some sites use a modern CSP directive instead of an older header, and the correct configuration depends on how the site is built.
Use the linked security headers guide to understand each control before making changes. Content-Security-Policy in particular should be tested carefully because an overly restrictive policy can break legitimate site functionality.
Why a standalone header check is useful
Security headers are externally visible and can change when hosting, CDN, reverse-proxy or application settings change. A quick checker gives developers and business owners a repeatable way to confirm what browsers are receiving right now.
For a broader view, ScoutLab's free website security scan checks headers together with HTTPS, DNS and email-authentication signals.
Read header values before changing configuration
For example, X-Content-Type-Options: nosniff asks browsers to respect the declared content type. Merely returning that header with a different value does not establish that the intended protection works. This checker displays observed values; it does not certify their effectiveness.
A Content-Security-Policy containing default-src * is much more permissive than a policy tailored to your resources. Conversely, a missing X-Frame-Options may be intentional when an enforced CSP frame-ancestors directive supplies framing protection. Five headers present is a count, not a security score.
The check requests the effective public HTTPS page, not every URL or authenticated response. Headers can differ on login, checkout, error and cached pages. Inspect those document responses in your browser's Network panel after hosting or CDN changes.
It reads selected HTTP response headers returned by a public website and shows which browser-facing security controls are present. ScoutLab checks HSTS, CSP, X-Frame-Options, X-Content-Type-Options and Referrer-Policy.
Are security headers enough to secure a website?
No. They reduce specific browser-side risks but do not patch software, secure administrator accounts, remove malware or replace vulnerability assessment and penetration testing where those are required.
Does this tool make changes to my website?
No. It is a passive external check. It requests the public HTTPS page and reports a bounded set of response-header and certificate facts; it does not exploit, modify or log in to the target.
Does the checker detect a Report-Only or HTML meta CSP?
The displayed CSP field reads the Content-Security-Policy response header. A Content-Security-Policy-Report-Only header or HTML meta policy is outside this field. Not observed therefore does not prove that your page has no CSP of any kind; inspect the document response and HTML to distinguish them.
