Review security response headers
Enter a public URL and review missing and present security headers with a summary score.
Input
https://example.com
Output
Security header checks and score
Network, IP, DNS, And Security Tools
Security Headers Checker
Check recommended HTTP security headers for a public URL with a server-side lookup.
Waiting
Uses Convurter servers for lookup or processing. Do not enter secrets.
Input
Security Headers Checker. This lookup uses public network records and responses. Do not enter secrets or private URLs.
Enter a public HTTP or HTTPS URL to run this lookup.
Guide
How to use Security Headers Checker
Step-by-step
- Enter url for a bounded Convurter server lookup.
- Run the inspection lookup and review the point-in-time response.
- Review the security-header-report result, then copy or download it if the workbench offers that action.
- Use the related tools on this page for cleanup, validation, conversion, or the next step in the workflow.
Questions
Is Security Headers Checker free to use?
Yes. The public lookup is free to use with bounded rate limits.
Are my files uploaded?
No files are uploaded, but the entered lookup target is sent to Convurter servers to fetch the public response. Do not enter secrets.
What should I check before using the security-header-report result?
Checks evaluate header presence and basic policy coverage. Review the final output before using it in production work.
What can I do after this?
Good next steps include HTTP Headers Checker, SSL Checker, and HTTP Status Checker.
Workflow fit
Use Security Headers Checker in the right place
If you are unsure, use the related tools and family hub to choose the closest workflow before committing to an output.
Best for
- Point-in-time network, DNS, HTTP, email DNS, SSL, redirect, IP, or password checks that need a quick operational signal.
- Support tickets, implementation QA, and configuration review before deeper security testing.
- A focused inspect task where the expected output is security-header-report.
Before you start
- This tool runs in the browser, so keep the tab open until the result is created and downloaded or copied.
- Use domains, public hosts, and values you are authorized to inspect.
- Avoid pasting private keys, production secrets, or credentials into lookup-style tools.
- Network answers can differ by resolver, cache, region, and timing.
- Use the report as a decision aid, then route to cleanup, conversion, or verification tools if it finds something notable.
Quality checks
- Treat inspection output as a signal report, not as a guarantee that every possible issue was checked.
- Treat results as a point-in-time signal, not a complete security audit.
- Recheck after DNS, certificate, redirect, or header changes have propagated.
- Escalate critical production security questions to a full security review.
- Copy or download the result only after confirming the displayed output matches the task you intended.
Common mistakes
- Assuming one successful lookup proves every region or client sees the same result.
- Treating a header, SSL, or DNS report as proof that the entire application is secure.
- Ignoring caching and propagation windows after configuration changes.
- Skipping input review because the tool feels instant.
- Treating the first result as final without checking the destination requirement.
Continue the workflow
Use these when the current result is only one step in a longer task.
Verify or clean up
Use these when the output needs checking, cleanup, comparison, compression, or a final share-ready pass.
Execution depth
Finish the job with fewer retries
Use these checks when the result will be emailed, uploaded, published, imported, or used as a final handoff copy.
Good uses
- Review launch headers for a public website.
- Check whether redirect and SSL setup should be investigated next.
Bad inputs
- Private network targets.
- Assuming the result is a full security audit.
Output checklist
- Check missing or weak headers.
- Compare with SSL and redirect results.
- Re-run after deployment changes.
Failure modes
- Blocked or unreachable hosts return lookup errors.
- Results can differ by region or cache.
- Headers alone do not prove site security.
Runtime limits
- Server lookup.
- Public URLs only.
- No private-network scan.