Security headers checker
Security headers are settings your server sends that tell the browser to block common attacks. This free checker reads your live site's response headers and lists the protective ones that are missing.
Run the check
What this checks
It checks five headers that matter: Content-Security-Policy (limits what scripts can run), Strict-Transport-Security (forces HTTPS), X-Frame-Options or a CSP frame-ancestors (stops clickjacking), X-Content-Type-Options (stops MIME sniffing), and Referrer-Policy (keeps URLs with tokens out of the Referer).
Why it gets missed
AI build tools focus on features and usually skip these, because the app looks and works the same without them. They are quick to add once you know which are missing, which is exactly what this tells you.
See the full step-by-step fix, with a copy-paste block for your AI tool →