Security Header Checker

Understand HSTS, CSP, framing, referrer, and browser security headers.

How it works

SiteCheck makes a bounded request to a public HTTP or HTTPS target, validates every DNS result and redirect, and returns a plain-language finding. Results are transient and are not used to build a history of your scans.

FAQ

Can I scan a private address?

No. Loopback, private, link-local, metadata, multicast, and reserved IPv4 and IPv6 ranges are rejected before any connection.

Do you store my report?

No permanent scan history is stored by default. Use JSON export if you want a local copy.