Deutsch

HTTP Security Headers Checker

Check which security headers your WordPress site sends – and how to fix the missing ones.

HTTP security headers are response headers your web server sends with every request. They tell the browser how to render your site more safely – invisible to visitors, but critical for security.

Paste your website's response headers to get a security score, a per-header breakdown, and ready-to-use WordPress code for any missing headers.

Chrome/Edge: Open DevTools (F12) → Network tab → reload the page → click a request → "Headers" tab → select and copy "Response Headers".
Firefox: Open DevTools (F12) → Network → click a request → "Response Headers" → right-click "Copy All".

What are HTTP Security Headers?

HTTP security headers are response headers your web server sends with every request. They tell the browser how to render your site more safely – e.g. which resources are allowed to load, whether the page can be embedded in an iframe, and whether only encrypted connections are allowed.

They are invisible to visitors, but critical for security: without them you leave many decisions to browsers that attackers can exploit.

Why security headers matter for WordPress

WordPress is the most widely used CMS in the world – and therefore the most frequent target. Many attacks (clickjacking, MIME-sniffing, XSS) can be prevented or significantly hindered by correctly configured security headers. Standard WordPress installations do not send these headers automatically.

Common mistakes

Implementing security headers in WordPress

Use the export section above to get ready-to-use code for .htaccess, nginx, or a functions.php (PHP) snippet for every header that is missing or weak – tailored to your actual results.

Frequently Asked Questions

What is a security header check and why does it matter?

HTTP response headers are instructions from your server to the browser on how to render your page more safely. A check shows you which of these protections are missing or misconfigured – before attackers can exploit them.

Why does the tool ask for pasted headers instead of fetching the URL itself?

This website is hosted as a purely static site and does not perform server-side requests – for privacy and security reasons as well. The upside: the tool works just as well for localhost, staging environments behind basic auth, or internal networks – just copy the headers from your own DevTools.

How do I copy response headers from Chrome or Firefox?

Chrome/Edge: open DevTools (F12), switch to the Network tab, reload the page, click the first request, in the "Headers" tab select and copy the "Response Headers" section. Firefox: open DevTools (F12), open the Network panel, click a request, under "Response Headers" right-click "Copy All".

Which headers does the tool check?

Content-Security-Policy, Strict-Transport-Security, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, X-XSS-Protection, and Cross-Origin-Opener-Policy.

How is the score calculated?

Each header is weighted by its security impact (3 to 30 points, 100 total). The total score maps to four grades: 90–100 Excellent, 70–89 Good, 40–69 Needs Improvement, 0–39 Critical.

What does it mean if Content-Security-Policy is flagged as critically missing?

CSP is weighted highest at 30 of 100 points, since it is the most effective defense against Cross-Site Scripting. Without it, injected JavaScript can run unimpeded.

How do I implement the recommended headers in WordPress?

After running a check, use the export section: it provides ready-to-use code for .htaccess, nginx, or a PHP snippet for functions.php – limited to the headers that are actually missing or weak for you.

Can I also test local or internal websites?

Yes. Since the tool never makes its own request to your website, it works with any URL – localhost, password-protected staging, or an internal network. Just copy the headers from that environment's DevTools.