Free tool — no signup required

Check any site's security headers for free.

HSTS, Content-Security-Policy, X-Frame-Options, and more — each graded on its actual value, not just presence, with a plain-English reason why it matters.

Try:
Fetching headers in real time…
https://github.com 200 OK ⚡ 0.01 ms
64
Security score
Some headers missing or weak
A few headers are missing, weak, or only report-only.
Strict-Transport-SecurityStrong
Forces browsers to use HTTPS for future visits, closing the window where a man-in-the-middle can downgrade the very first request to plain HTTP.
max-age=31536000; includeSubdomains; preload
Content-Security-PolicyWeak
Restricts which sources scripts/styles/frames can load from, the primary browser-side defense against XSS — a permissive or missing policy lets injected script run with full page privileges.
default-src 'none'; base-uri 'self'; child-src github.githubassets.com github.com/assets-cdn/worker/ github.com/assets/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com www.githubstatus.com collector.github.com raw.githubusercontent.com api.github.com github-cloud.s3.amazonaws.com github-production-repository-file-5c1aeb.s3.amazonaws.com github-production-upload-manifest-file-7fdce7.s3.amazonaws.com github-production-user-asset-6210df.s3.amazonaws.com *.rel.tunnels.api.visualstudio.com wss://*.rel.tunnels.api.visualstudio.com github.githubassets.com objects-origin.githubusercontent.com copilot-proxy.githubusercontent.com proxy.individual.githubcopilot.com proxy.business.githubcopilot.com proxy.enterprise.githubcopilot.com *.actions.githubusercontent.com wss://*.actions.githubusercontent.com productionresultssa0.blob.core.windows.net productionresultssa1.blob.core.windows.net productionresultssa2.blob.core.windows.net productionresultssa3.blob.core.windows.net productionresultssa4.blob.core.windows.net productionresultssa5.blob.core.windows.net productionresultssa6.blob.core.windows.net productionresultssa7.blob.core.windows.net productionresultssa8.blob.core.windows.net productionresultssa9.blob.core.windows.net productionresultssa10.blob.core.windows.net productionresultssa11.blob.core.windows.net productionresultssa12.blob.core.windows.net productionresultssa13.blob.core.windows.net productionresultssa14.blob.core.windows.net productionresultssa15.blob.core.windows.net productionresultssa16.blob.core.windows.net productionresultssa17.blob.core.windows.net productionresultssa18.blob.core.windows.net productionresultssa19.blob.core.windows.net github-production-repository-image-32fea6.s3.amazonaws.com github-production-release-asset-2e65be.s3.amazonaws.com insights.github.com wss://alive.github.com wss://alive-staging.github.com api.githubcopilot.com api.individual.githubcopilot.com api.business.githubcopilot.com api.enterprise.githubcopilot.com wss://production-copilot-host.webpubsub.azure.com edge.fullstory.com rs.fullstory.com; font-src github.githubassets.com; form-action 'self' github.com gist.github.com copilot-workspace.githubnext.com objects-origin.githubusercontent.com; frame-ancestors 'none'; frame-src viewscreen.githubusercontent.com notebooks.githubusercontent.com www.youtube-nocookie.com; img-src 'self' data: blob: github.githubassets.com media.githubusercontent.com camo.githubusercontent.com identicons.github.com avatars.githubusercontent.com private-avatars.githubusercontent.com github-cloud.s3.amazonaws.com objects.githubusercontent.com release-assets.githubusercontent.com secured-user-images.githubusercontent.com user-images.githubusercontent.com private-user-images.githubusercontent.com opengraph.githubassets.com repository-images.githubusercontent.com marketplace-screenshots.githubusercontent.com copilotprodattachments.blob.core.windows.net/github-production-copilot-attachments/ github-production-user-asset-6210df.s3.amazonaws.com customer-stories-feed.github.com spotlights-feed.github.com explore-feed.github.com objects-origin.githubusercontent.com *.githubusercontent.com images.ctfassets.net/8aevphvgewt8/; manifest-src 'self'; media-src github.com user-images.githubusercontent.com secured-user-images.githubusercontent.com private-user-images.githubusercontent.com github-production-user-asset-6210df.s3.amazonaws.com gist.github.com github.githubassets.com assets.ctfassets.net/8aevphvgewt8/ videos.ctfassets.net/8aevphvgewt8/; script-src github.githubassets.com; style-src 'unsafe-inline' github.githubassets.com; upgrade-insecure-requests; worker-src github.githubassets.com github.com/assets-cdn/worker/ github.com/assets/ gist.github.com/assets-cdn/worker/
X-Frame-OptionsStrong
Prevents the page from being embedded in a hidden iframe on another site, the standard defense against clickjacking.
deny
X-Content-Type-OptionsStrong
Stops the browser from guessing ("sniffing") a response's MIME type, closing off attacks where a file is served as one type but rendered/executed as another.
nosniff
Referrer-PolicyReasonable
Controls how much of the current URL leaks to third parties in the Referer header when a user follows an outbound link — relevant if URLs ever carry tokens or IDs.
origin-when-cross-origin, strict-origin-when-cross-origin
Permissions-PolicyMissing
Explicitly disables browser features (camera, geolocation, etc.) the page doesn't use, shrinking what an attacker gains even if they get script execution.
Not sent by this server.

This is one of nine checks in the full API — SEO audit, tech stack detection, public contacts, product data, and AI-ready Markdown, all from the same one HTTP call. Free tier, 1,000 requests/month, no card required.

Try the full API free →

Run an agency or a dev blog? Embed this checker on your own site for free — visitors run real checks, no signup, no API key needed.