Security Headers Checker

What this checks

The tool fetches your site's response headers and grades them against the six that matter most for a WordPress install:

• Strict-Transport-Security (HSTS) tells browsers to only ever load your site over HTTPS. Essential once you have a valid certificate.
• Content-Security-Policy restricts what scripts, styles, and images can load. The nuclear option for stopping cross-site scripting, but the hardest to get right on WordPress.
• X-Frame-Options stops another site from loading yours inside an iframe. Blocks clickjacking on your login page.
• X-Content-Type-Options tells browsers not to guess a file's type. Stops a "harmless" upload being served as executable JavaScript.
• Referrer-Policy controls how much of the referring URL leaks to third parties. A leaky policy exposes admin URLs, staging paths, and search queries.
• Permissions-Policy shuts down browser features you don't need. Cameras, microphones, geolocation, USB. If WordPress isn't using them, disable them.

Enter a URL to check. Redirects are followed, so example.com and http://example.com will both land on your canonical HTTPS response.

What it doesn't check

This is a header audit, not a security scan. It won't tell you if your admin login is exposed, if your plugins are out of date, or if there's malware on the site. It's the first ten minutes of a full audit, not the whole audit.

If you want the full picture, Chapter 6 of Protect My WP covers the headers themselves. Chapter 10 covers monitoring, and the full book covers everything else.