Security headers check

Follows the redirect chains from http:// and https:// (at most five hops each, public hosts on ports 80 and 443 only) and reads HSTS, Content-Security-Policy, X-Content-Type-Options, frame protection, Referrer-Policy and cookie flags of the final HTTPS response. Page bodies are not read.

Updated 2026-10-26

What this tool checks

The check starts two redirect chains, one at http://<domain>/ and one at https://<domain>/, and follows each the way a browser would:

Redirects: every hop with its status code and Location. At most five redirects are followed per chain (REDIRECT_LIMIT beyond that). Only http and https URLs on ports 80 and 443 with public host names are followed; anything else stops the chain.
HTTP to HTTPS: whether the plain HTTP chain ends on HTTPS (HTTP_NO_HTTPS_REDIRECT), and whether HTTPS works at all (HTTPS_UNAVAILABLE).
Strict-Transport-Security: the raw value and the parsed max-age, includeSubDomains and preload. A missing or invalid header is HSTS_MISSING; a max-age under one year is HSTS_SHORT_MAX_AGE.
Content-Security-Policy: present or not (CSP_MISSING), and whether scripts are allowed inline without a nonce or hash, or through eval() (CSP_UNSAFE_INLINE). A Report-Only policy is shown but not counted.
Other headers: X-Content-Type-Options (XCTO_MISSING), frame protection through X-Frame-Options or frame-ancestors (FRAME_PROTECTION_MISSING), Referrer-Policy (REFERRER_POLICY_MISSING), Permissions-Policy and Cross-Origin-Opener-Policy.
Cookies: the name and the Secure, HttpOnly and SameSite attributes of up to 20 cookies, never their values. A cookie without Secure is COOKIE_NOT_SECURE.

The headers are read from the final HTTPS response of the https:// chain.

How to read the result

Start with the two chains. If HTTPS fails, nothing else can be judged. If plain HTTP does not reach HTTPS, visitors who type the bare name stay unencrypted until HSTS is in place. The header findings after that are information for you to weigh against what the site does.

The TLS certificate check looks at the certificate behind the HTTPS connection in detail.

Limitations

Only the start page is requested, with Accept: text/html. Other paths and API endpoints can send other headers.
Headers set by JavaScript or in <meta> tags are not seen, because pages are not read.
The check follows at most five redirects per chain and gives the whole check ten seconds.

Use it from code

API reference for Security headers check

curl -i "https://api.lookproof.dev/v1/http/security-headers?domain=example.com"

A request without payment is answered with 402 Payment Required and the exact price. See the API reference.

Limits

Input	Domain
Deadline	15 seconds
Freshness	Up to 5 minutes, never longer than the record TTL
Price	$0.01 per check

Findings this tool can report

HTTP (2)

Warning HTTP_NO_HTTPS_REDIRECT Plain HTTP is not redirected to HTTPS.
Info HTTP_UNAVAILABLE The site does not answer over plain HTTP.

Cookies (1)

Warning COOKIE_NOT_SECURE The HTTPS site sets a cookie without the Secure attribute.

Content Security Policy (2)

Info CSP_MISSING The HTTPS site sends no Content-Security-Policy header.
Info CSP_UNSAFE_INLINE The Content Security Policy allows inline or eval'd scripts.

Frame protection (1)

Info FRAME_PROTECTION_MISSING The HTTPS site does not restrict who may frame it.

HSTS (3)

Warning HSTS_MISSING The HTTPS site sends no valid Strict-Transport-Security header.
Info HSTS_NOT_PRELOAD_READY The domain does not meet the HSTS preload requirements.
Info HSTS_SHORT_MAX_AGE The HSTS max-age is shorter than one year.

HTTPS (1)

Error HTTPS_UNAVAILABLE The site could not be loaded over HTTPS.

Redirects (2)

Warning REDIRECT_LIMIT The site redirects more than five times in a row.
Info REDIRECT_OFFSITE The site redirects to another domain.

Referrer-Policy (1)

Info REFERRER_POLICY_MISSING The HTTPS site sends no Referrer-Policy header.

X-Content-Type-Options (1)

Info XCTO_MISSING The HTTPS site sends no X-Content-Type-Options: nosniff header.

Frequently asked questions

Why are most header findings only information?

Whether a page needs a header depends on the page. A static brochure site gains little from a strict Content Security Policy, while a web application with logins gains a lot. The check reports what is there and what is missing; HSTS, the redirect to HTTPS and cookies without Secure are warnings, because they matter for almost every site.

What does HSTS preload ready mean?

Browsers ship a list of domains that are only ever opened over HTTPS, even on the first visit. hstspreload.org accepts a domain when its HSTS header has a max-age of at least one year, includeSubDomains and preload, and when plain HTTP redirects to HTTPS on the same host. HSTS_NOT_PRELOAD_READY lists what is missing. Getting onto the list is optional and slow to undo.

Why does a redirect to my www host not count as offsite?

www.example.com belongs to the same registrable domain as example.com, the same site in browser terms. REDIRECT_OFFSITE is only reported when a redirect leaves the domain, for example to a hosting provider's default page or a parking service.

Does the check read my pages?

No. It sends plain GET requests without cookies and reads only the status line and headers of each response. The body is never read, and nothing is stored.