Free security headers checker
Is your website sending the security headers browsers expect?
Data protection law expects 'appropriate technical measures' to protect visitors' data. We check the basics every website should have: a working HTTPS setup, HSTS, a Content-Security-Policy, clickjacking protection and a safe Referrer-Policy, and show the law each one relates to.
What we test
HTTPS works and HTTP redirects to it
We check your certificate is valid and that plain http:// addresses send visitors to the secure version.
UK/EU GDPR Art. 32
Strict-Transport-Security (HSTS) is set
We read your response headers for HSTS, which tells browsers to only ever connect to your site securely.
UK/EU GDPR Art. 32
Content-Security-Policy (CSP) is set
We check for a CSP header, which limits which scripts can run on your pages and reduces the damage of injected code.
UK/EU GDPR Art. 32 · FTC Act §5
Clickjacking protection (X-Frame-Options)
We check X-Frame-Options or the CSP frame-ancestors rule stops other sites showing your pages in a hidden frame.
UK/EU GDPR Art. 32
Referrer-Policy doesn't leak page addresses
We check your pages don't send full addresses, which can contain search terms, emails or order numbers, to other sites.
UK/EU GDPR Art. 32
What your free report shows
Free
- Your Risk Score and risk band
- Pass or fail on each security test
- The law each test relates to
- Full detail and fix for 1 lower-risk issue
Paid plans
- The exact headers we received
- Full detail on serious issues
- Ready-to-paste header values
- PDF export and regular monitoring
Questions
Is the security headers checker free?
Yes. You can scan any website once a day for free with no sign-up. Paid plans unlock full evidence, fixes and regular monitoring.
Which security headers does Halvus check?
Halvus checks that HTTPS works with a valid certificate and an HTTP redirect, and reads the Strict-Transport-Security (HSTS), Content-Security-Policy (CSP), X-Frame-Options and Referrer-Policy headers. It does not test Permissions-Policy.
What is clickjacking and how does X-Frame-Options stop it?
Clickjacking is when another site loads your page inside an invisible frame and tricks visitors into clicking buttons on it. Setting X-Frame-Options to DENY or SAMEORIGIN, or a CSP frame-ancestors rule, tells browsers not to show your pages inside other sites' frames. ALLOW-FROM is ignored by current browsers.
Do I need a Referrer-Policy header?
Current browsers default to strict-origin-when-cross-origin, which only shares your domain with other sites, so having no header is low risk. The real risk is a policy such as unsafe-url or no-referrer-when-downgrade, which sends full page addresses, including any personal data in them, to third parties. Halvus flags those.
What is HSTS?
HTTP Strict-Transport-Security is a response header that tells browsers to only connect to your site over HTTPS for a set period, which protects visitors from being downgraded to an insecure connection. A common value is max-age=31536000; includeSubDomains.
What is a Content-Security-Policy?
A Content-Security-Policy (CSP) header lists where your pages are allowed to load scripts, styles and other resources from. It makes cross-site scripting attacks much harder. Many sites start with a report-only policy, review what it would block, then enforce it.
Are security headers a legal requirement?
No law names specific headers. But UK and EU GDPR Article 32 requires appropriate technical measures to protect personal data, and regulators look at whether widely used, low-cost protections were in place. Missing basics can count against you after an incident.
Does the full scan check anything else?
Yes. The same scan also tests cookie consent, privacy policy, consumer law, accessibility and AI labelling, and checks your company details are shown on the site.
Halvus reports risks found, not legal advice.