HTTP security headers checker
Enter a URL to see its HTTP response headers and a quick grade on the security headers that matter.
How to use the http security headers checker
- Enter a URL.
- Press Check.
- Review which security headers are present and which are missing.
The headers that matter
The high-value security headers are HSTS (forces HTTPS), Content-Security-Policy (limits what can load), X-Content-Type-Options, X-Frame-Options (anti-clickjacking), Referrer-Policy, and Permissions-Policy. They tell browsers how to defend your visitors against common attacks. Pair this with the SSL certificate checker.
Code & API examples
Use this from the command line or your code. The API is free, GET-only, and returns JSON.
API (curl)
curl "https://vpn.golf/api/tools/headers?url=example.com"Shell
curl -sI https://example.comSee all endpoints at /api/tools/.
Frequently asked questions
HSTS (forces HTTPS), Content-Security-Policy (limits what loads), X-Content-Type-Options, X-Frame-Options (clickjacking), and Referrer-Policy are the high-value ones.
They tell browsers how to defend your visitors against common attacks like clickjacking, content injection, and protocol downgrade.
Strict-Transport-Security tells browsers to only ever connect over HTTPS for a set period, preventing downgrade attacks and stripping. Add includeSubDomains and preload for the strongest version.
CSP is a header that whitelists which sources of scripts, styles, images, and frames a page may load. A tight policy is the single most effective defense against cross-site scripting.
Set X-Frame-Options to DENY or SAMEORIGIN in your web server or app config, or use the modern frame-ancestors directive in your CSP, which supersedes it.
Both control who can embed your page in a frame. X-Frame-Options is the older header; CSP's frame-ancestors is more flexible and is what browsers prefer when both are present.
This tool fetches the URL server-side from vpn.golf's network, so it sees the raw response without your extensions, cache, or cookies. A CDN may also serve different headers by region or request.
It reports the response for the URL you enter. If a site redirects HTTP to HTTPS, check the HTTPS URL directly so you grade the headers visitors actually receive.
Yes. Referrer-Policy controls how much URL info leaks to other sites, and Permissions-Policy restricts powerful browser features like camera and geolocation. Both reduce exposure with no downside for most sites.
They advertise your software and version, helping attackers target known vulnerabilities. Remove or generalize them so you're not handing out a fingerprint.
Yes — vpn.golf offers a free GET-only JSON endpoint at /api/tools/headers that returns the same response headers and grading, so you can wire it into monitoring or CI.
No. They're a few bytes in the response and add no measurable latency. The only cost is testing that a strict CSP doesn't block legitimate resources before you enforce it.
Related tools
Want to hide your IP for real?
vpn.golf is a no-logs WireGuard VPN. Pick a hole, take the shot.
Step up to the tee — free