What the check looks at
Security headers are instructions your site sends with every page, telling the visitor's browser which protections to turn on. We request your home page once, the way a browser does, and read them:
- Strict-Transport-Security (HSTS) — missing is flagged high; a max-age under one year is flagged medium.
- Content-Security-Policy — missing is flagged medium, and so is allowing
unsafe-inlineorunsafe-eval. - X-Frame-Options — missing is flagged medium.
- X-Content-Type-Options, Referrer-Policy, Permissions-Policy — missing is flagged low.
- Cookies — a cookie set without the Secure, HttpOnly or SameSite flag is flagged medium.
Why it matters
Without X-Frame-Options, another site can load your login or booking page inside an invisible frame and line up its own button over yours. A visitor who thinks they are clicking something harmless is really clicking on your page, signed in as themselves. Without HSTS, a customer on public Wi-Fi who types your address can be kept on an unencrypted connection without noticing.
What this check doesn't cover
We read the headers on your home page only. Other pages, an admin area or a separate app may send different headers.
Free scan or Pro
The free scan shows every issue it finds, how serious each one is and what it means, in plain English, plus your Ghost Score out of 100. No account needed.
Pro adds step-by-step fix instructions for each issue, a Top-3 action plan, a PDF report and your score history, for domains you have verified you own.
Questions
Which security headers does it check?
Strict-Transport-Security (HSTS), Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy and Permissions-Policy. It also checks the cookies your home page sets for the Secure, HttpOnly and SameSite flags.
Does a missing header mean my site has been hacked?
No. A missing header means a browser protection is switched off. It is a gap that makes some attacks easier, not a sign that one has happened.
Which pages does it check?
Your home page. Other pages, an admin area or a separate app can send different headers, and those are not checked.
Is the security headers check free?
Yes. The scan, your Ghost Score and every finding with its explanation are free, with no account needed. Step-by-step fix instructions are part of Pro.