Security headers check

Is the site telling browsers to protect its visitors?

Live lookupPlain English + technicalFree, no sign-upheaders.middle.network

How to read the results

Each header is present (green) or missing (grey), weighted by importance.
CSP and HSTS carry the most points.

Check everything at once

The health check runs this and 30 more checks on a domain, then ranks what to fix.

Guides for auditors

Compliance checks

Domain audit Domain security audit ISO 27001 domain compliance check SOC 2 domain security check Cyber security compliance check

More in Website and HTTP

HTTP checkLoad a URL and break down DNS, connect, TLS and first byte.
Is it down?Is a website down for everyone or just you?
Geoblock checkerSee which countries can open a URL and which are blocked.
Redirect tracerTrace every redirect from first URL to final page.
Website speedTime a page load and weigh its assets.
HTTP/2, HTTP/3, IPv6 supportCheck HTTP/2, HTTP/3 and IPv6 support.
What’s that site running?See every technology a website runs: CDN, host, CMS, scripts and trackers.
robots.txt, sitemap, llms.txtCheck robots.txt, sitemap, llms.txt and security.txt.
Sitemap inspectorValidate a sitemap, follow its index and spot risks.
Meta tag / link checkerPreview search and social cards, find broken links.

About the Security headers

Grade a website’s HTTP security headers (HSTS, CSP, X-Frame-Options, Referrer-Policy, Permissions-Policy) from A to F with fixes.

Every result comes in two styles: plain English for everyone, and the exact technical detail for engineers, with the raw JSON one click away.

Questions

HSTS and nosniff rarely do. Test a CSP in report-only mode first.