DE EN IT

~/tools / security-headers-checker

Security headers checker

Enter a URL — see which protective headers are set and which are missing.

daniele@mikweb: ~/tools — less security-headers-checker.md

The headers that matter

  • Strict-Transport-Security: browsers only use HTTPS (at least 180 days).
  • Content-Security-Policy: defines where scripts may come from — the best protection against XSS, without 'unsafe-inline' for scripts.
  • X-Content-Type-Options: nosniff, X-Frame-Options or frame-ancestors, Referrer-Policy and Permissions-Policy.
  • No version numbers in Server or X-Powered-By.

Privacy

The domain or address you enter is sent to this server, which runs the check. Nothing is stored; to prevent abuse a salted hash of your IP address is kept for one hour. Only public addresses are queried.

daniele@mikweb: ~/blog — ls

Related articles

Three critical NGINX flaws: less dramatic than PHP2Shell, but patch them quickly anywayNGINX fix in 1.30.6 and 1.31.7 (Plus 37.1.0.1, 37.0.5.1): which configurations are affected, how to check them and how to update containers.PHP emergency patch (PHP2Shell): how to check and patch your serversTwo critical PHP flaws, fixed in 8.5.12, 8.4.27, 8.3.36 and 8.2.35: where PHP really runs, how to check the version, patch and restart — with a worked example.
daniele@mikweb: ~/tools — ls

Tools

SPF checkerCounts the DNS lookups of your SPF record (limit: 10).DNS TTL plannerPlans the TTL reduction and the move time.Cron explainerExplains cron expressions and shows the next runs.DMARC generatorBuilds a valid DMARC record to copy.Mail DNS checkChecks MX, reverse DNS, SPF, DMARC and MTA-STS of a domain.Certificate checkExpiry, chain and names of a TLS certificate.JWT decoderShows header, claims and expiry of a JWT — in your browser only.SAML decoderDecodes SAML responses and spots typical errors.

← Tools