GmorkFree tool
Enter a website to see which of the six recommended HTTP security headers its homepage sends, which values are weak, and whether it reveals software versions. Free, no signup.
Each one is a single line of server configuration. Here is what it does and a sensible starting value.
Tells browsers to always use https for your site, so a connection cannot be quietly downgraded to http on an untrusted network.
Strict-Transport-Security: max-age=31536000; includeSubDomainsSix months (15552000 seconds) is the minimum Gmork considers strong. Only add includeSubDomains if every subdomain has https.
Lists where scripts, styles, images and frames may load from. It blunts injected scripts, such as card skimmers, that point at an attacker’s domain.
Content-Security-Policy: default-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'Start with Content-Security-Policy-Report-Only to see what would break, then enforce. Report-only alone blocks nothing.
Stops other sites from framing your pages to trick visitors into clicking (clickjacking). A CSP frame-ancestors rule does the same job and counts here.
X-Frame-Options: DENYUse SAMEORIGIN if your own site frames its pages.
Stops the browser from guessing file types, so an uploaded file cannot be run as a script.
X-Content-Type-Options: nosniffnosniff is the only valid value.
Controls how much of your page address is sent to other sites when visitors click away or the page loads outside resources.
Referrer-Policy: strict-origin-when-cross-originAvoid unsafe-url, which sends full addresses, including query strings, to every site.
Turns off browser features your site does not use, like camera, microphone or location, so injected code or embeds cannot request them.
Permissions-Policy: camera=(), microphone=(), geolocation=()Leave out any feature the site really uses, or allow it for your own origin with (self).
The checker also notes an X-Powered-By header, or a Server header with a version number such as nginx/1.18.0. They are not vulnerabilities by themselves, but they make outdated software easy to spot. They never count toward the six.
Most servers and frameworks can remove them, for example server_tokens off in nginx.
Want the longer version? Read Security headers explained.
Strict-Transport-Security (HSTS), Content-Security-Policy, X-Frame-Options (or the CSP frame-ancestors rule), X-Content-Type-Options, Referrer-Policy and Permissions-Policy. It also notes when the Server or X-Powered-By header reveals software versions.
No. Security headers are hardening: they make some attacks harder or limit the damage. A missing header is advice to improve, not evidence of a compromise.
The homepage you enter, after following redirects. Headers can differ between pages, so check important pages separately if they are served by a different system.
Yes, with no account. It is rate limited so that everyone can use it, and every site added to Gmork gets the same header check on each run.
Worried about more than headers? Try the free website hacked check.