Check your website's security headers and SSL
Free security headers checker. Test HSTS, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, SSL certificate expiry, TLS version and mixed content.
Security headers are instructions your server sends with every page that tell browsers how to protect your visitors. They take minutes to add, and most sites built from templates do not have them.
What this checker tests
- HTTPS availability and redirect from HTTP
- SSL certificate validity, issuer and days until expiry
- TLS protocol version
Strict-Transport-Securityand its max-ageContent-Security-Policy, includingunsafe-inlinescripts- Clickjacking protection (
frame-ancestorsorX-Frame-Options) X-Content-Type-Options,Referrer-Policy,Permissions-Policy- Cookie
SecureandHttpOnlyflags - Mixed content and forms that submit over HTTP
- Server version disclosure
For copy-paste configurations, read Security headers explained.
Checks included
| Check | Severity | How to fix |
|---|---|---|
| Site is not available over HTTPS Without HTTPS, everything your visitors send and receive can be read or modified in transit, and browsers label the site "Not secure". | critical | Enable a TLS certificate (free from Let's Encrypt or your host) and serve the site on https://. |
| HTTP does not redirect to HTTPS Visitors who type your domain without https:// stay on an unencrypted connection. | medium | Add a permanent (301/308) redirect from http:// to https:// at your host, CDN or web server. |
| SSL/TLS certificate is not valid Browsers show a full-page security warning, and most visitors leave. | critical | Renew or re-issue the certificate for this exact hostname and make sure the full certificate chain is installed. |
| SSL certificate expires in less than 14 days When it expires, browsers block the site with a security warning. | high | Renew the certificate now and check that automatic renewal is working. |
| SSL certificate expires within 30 days Auto-renewal sometimes fails silently. Expired certificates take sites offline for visitors. | medium | Confirm auto-renewal is configured, or renew manually. |
| Outdated TLS protocol negotiated TLS 1.0 and 1.1 are deprecated and considered insecure. | medium | Disable TLS 1.0/1.1 and enable TLS 1.2 and 1.3 on your server or CDN. |
| Scripts or frames loaded over insecure HTTP Browsers block active mixed content, which breaks features, and an attacker on the network could inject code. | medium | Load every script, stylesheet and iframe over https://. |
| Images or media loaded over insecure HTTP Mixed content removes the padlock and can be tampered with in transit. | low | Change the image/media URLs to https://. |
| Form submits to an insecure HTTP address Anything typed into the form, including passwords or personal data, is sent unencrypted. | medium | Point the form action to an https:// URL. |
| Strict-Transport-Security (HSTS) header is missing Without HSTS, a visitor's first request can be downgraded to HTTP by an attacker on the same network. | medium | Send "Strict-Transport-Security: max-age=31536000; includeSubDomains" on HTTPS responses. |
| HSTS max-age is shorter than 6 months A short max-age gives weaker protection against downgrade attacks. | low | Raise max-age to at least 15552000 (180 days), ideally 31536000. |
| Content-Security-Policy header is missing CSP is the strongest browser defence against cross-site scripting (XSS) and injected scripts. | medium | Add a Content-Security-Policy. Start with default-src 'self' and allow only the domains you use; use nonces instead of 'unsafe-inline'. |
| CSP allows 'unsafe-inline' scripts 'unsafe-inline' lets injected inline scripts run, which removes most of CSP's XSS protection. | low | Replace 'unsafe-inline' in script-src with per-request nonces or hashes (most frameworks support this). |
| No clickjacking protection Other sites can embed your pages in an invisible frame and trick users into clicking. | low | Send "Content-Security-Policy: frame-ancestors 'self'" (or X-Frame-Options: DENY). |
| X-Content-Type-Options header is missing Browsers may "sniff" files as a different type, which can turn uploads into scripts. | low | Send "X-Content-Type-Options: nosniff". |
| Referrer-Policy header is missing Full URLs (which may contain tokens or private paths) can leak to third-party sites. | low | Send "Referrer-Policy: strict-origin-when-cross-origin". |
| Permissions-Policy header is missing Permissions-Policy limits which browser features (camera, microphone, location) embedded content can use. | info | Send e.g. "Permissions-Policy: camera=(), microphone=(), geolocation=()". |
| Cookies set without Secure or HttpOnly flags Cookies without Secure can travel over HTTP; without HttpOnly they can be read by injected scripts. | low | Set Secure, HttpOnly and SameSite on session and authentication cookies. |
| Server software version is disclosed Exact versions in headers help attackers find known vulnerabilities quickly. | low | Remove version numbers from the Server and X-Powered-By headers. |
This free tool runs the full passive Wardzo scan and shows these checks first. Nothing is stored in full: secrets are masked, and anonymous reports are deleted after 30 days.
Frequently asked questions
Which headers matter most?
Strict-Transport-Security and a Content-Security-Policy give the biggest security benefit. X-Content-Type-Options, Referrer-Policy and frame-ancestors (or X-Frame-Options) are quick wins.
Why does Wardzo flag 'unsafe-inline' in my CSP?
Allowing inline scripts removes most of CSP's protection against cross-site scripting. Use nonces or hashes instead.
Related
- Security headers explained: a practical setup for Next.js, Nginx and Caddy
What each HTTP security header does, sensible values to start with, and copy-paste configuration for Next.js, Nginx and Caddy, including a nonce-based Content-Security-Policy.
- What is a Content Security Policy (CSP)?
A Content Security Policy is an HTTP header that tells browsers which sources of scripts, styles and other resources a page may load, limiting the damage of cross-site scripting.
- What is HSTS (HTTP Strict Transport Security)?
HSTS is a security header that tells browsers to always use HTTPS for a site, preventing downgrade attacks and insecure first requests.