Content-Security-Policy
Whether the final safe HTTPS response sends a Content-Security-Policy header.
Free security tool
Free Security Headers Checker
Check whether a website sends important HTTP security headers and identify missing protections.
CloudSpex explains what each checked header does, why it matters and what should be changed when it is not detected.
What are HTTP security headers?
HTTP security headers are instructions sent with a website response. They can help browsers apply protections against common classes of browser-side risk, but a header being present does not by itself prove that its policy is suitable for every application.
What does CloudSpex check?
Strict-Transport-Security
Whether the final safe HTTPS response sends a Strict-Transport-Security header.
X-Frame-Options
Whether the final safe HTTPS response sends an X-Frame-Options header.
CloudSpex currently checks only whether Content-Security-Policy, Strict-Transport-Security and X-Frame-Options are present. It does not currently evaluate CSP strength, cookie flags, CORS or cross-origin isolation headers.
Common security header problems
A missing Content-Security-Policy can leave browser content restrictions undefined. Missing Strict-Transport-Security can mean a browser is not instructed to prefer HTTPS. A missing X-Frame-Options header means this checker did not detect that specific frame-control header; it does not determine whether a CSP frame-ancestors policy provides equivalent protection.
Why a header can be present but still weak
Header values must fit the application and its deployment. CloudSpex reports presence only in this check. It does not evaluate CSP directives, HSTS max-age or preload settings, or the quality of X-Frame-Options values.
One-time check vs continuous monitoring
One-time check
Shows the available header state on the current public response.
Continuous monitoring
Helps track HTTP security headers and related website configuration changes after deployments or proxy updates.
Frequently asked questions
What are HTTP security headers?
HTTP security headers tell browsers how to handle a website in ways that can reduce common security risks. They are sent by the website response and should be reviewed alongside the rest of the website configuration.
What does the CloudSpex security headers checker test?
CloudSpex currently checks whether Content-Security-Policy, Strict-Transport-Security and X-Frame-Options are present on the final safe HTTPS response.
What is Content-Security-Policy?
Content-Security-Policy is a response header that can define which content sources a browser is allowed to load. CloudSpex reports whether the header is present; it does not assess directive strength in this check.
What is Strict-Transport-Security?
Strict-Transport-Security is an HTTPS response header that instructs supporting browsers to use HTTPS for a period of time. It should be configured only after confirming the site is fully available over HTTPS.
Is a security header safe just because it is present?
No. A header can be present with a value that is not suitable for every application. This checker reports presence only and does not rate header strength.
Is this security headers check free?
Yes. This is a limited, read-only public check that uses the same protected CloudSpex Free Scan flow.
Does the checker make changes to the website?
No. CloudSpex reads a public HTTPS response only. It does not change website files, DNS, headers or any other configuration.
How often should security headers be checked?
Run a check after deployments, CDN or proxy changes. Continuous monitoring can help detect unexpected configuration changes between manual checks.
Security headers can disappear after a deployment or proxy change.
Add your domain to CloudSpex to monitor HTTP security headers and related website configuration changes.
Start Monitoring Free Check Another Website