Free tool

Security Headers Checker

See which HTTP security headers your site sends and what's missing. LaunchSafer runs a non-intrusive check of HTTPS, your certificate, redirects, security headers, cookies and mixed content.

Run the security headers checker

Free, no sign-up. You get the full LaunchSafer report, including the checks below, in 30–90 seconds.

The headers that matter

Strict-Transport-Security (HSTS) forces browsers to use HTTPS. Content-Security-Policy (CSP) limits which scripts can run, which blunts cross-site scripting. X-Frame-Options or frame-ancestors stops clickjacking, X-Content-Type-Options stops MIME sniffing, and Referrer-Policy controls what URLs leak to other sites.

For CSP, LaunchSafer also checks whether the policy allows 'unsafe-inline' scripts without nonces or hashes, which weakens its protection.

Non-intrusive by design

LaunchSafer only reads what your server sends to any visitor. It doesn't log in, submit forms or attempt exploits, so it's safe to run against production.

Frequently asked questions

Is this an HSTS checker?

Yes. It checks that Strict-Transport-Security is set, along with its max-age, and that HTTP redirects to HTTPS.

Is this a CSP checker?

It checks that a Content-Security-Policy is present and flags common weaknesses such as 'unsafe-inline' scripts without nonces or hashes.

What is mixed content?

An HTTPS page that loads images, scripts or styles over plain HTTP. Browsers block or warn about it, and it undermines HTTPS.