# Security headers check: free website security checker

> Free security headers checker: HSTS, X-Frame-Options and nosniff, plus certificate, https redirect and outdated JavaScript libraries, with the line to add.

Source: https://konformia.at/en/guides/security-headers-check

# Website security check: headers, certificate, old scripts

What your server sends with every request is visible to anyone: security headers, the certificate, the redirect to https and the versions of jQuery and Bootstrap. The scan reads all of it in one pass and names the line that closes each gap.

Free and without sign-up · no credit card · usually under two minutes · [See an example report](https://konformia.at/en/example)

## What is visible from outside

No attack and no intrusion: we only read what every browser gets on a normal visit. Automated attackers look at exactly that first.

| What | EU reference |
| --- | --- |
| **Strict-Transport-Security (HSTS)** Tells the browser to load your site over https only. Without it, the first visit can still go over unencrypted http. Common value: max-age=31536000. | Security, not a legal question |
| **X-Content-Type-Options** With nosniff the browser does not guess the file type but follows what the server says. An uploaded file then does not run as a script. | Security, not a legal question |
| **X-Frame-Options or frame-ancestors** Stops another site from embedding yours in an invisible frame (iframe) and capturing clicks (clickjacking). SAMEORIGIN allows only your own domain. | Security, not a legal question |
| **Certificate and https redirect** Whether the certificate is valid and trusted by browsers, when it expires and whether http:// redirects to https://. | Security, not a legal question |
| **Outdated JavaScript libraries** jQuery before 3.5.0, jQuery UI before 1.13.2 and Bootstrap before 3.4.1 (or 4.0 to 4.3.0) have known vulnerabilities with CVE numbers. We read the version from the loaded library, not from the file name. | Security, not a legal question |
| **Session cookie** Whether your system's session cookie (PHP, WooCommerce, Shopware, Magento …) carries Secure and HttpOnly, so it cannot be read over http or by a script. | Security, not a legal question |

## Step by step

### Look yourself

Open the home page, developer tools (F12), Network tab, reload and click the first row (the document). Under “Response Headers” you see which headers your server sets.

### Apache and most hosts

Add to the .htaccess in the root folder: `Header always set Strict-Transport-Security "max-age=31536000"`, `Header always set X-Content-Type-Options "nosniff"` and `Header always set X-Frame-Options "SAMEORIGIN"`. Only set HSTS once the site works fully over https.

### nginx

In the server block for https: `add_header Strict-Transport-Security "max-age=31536000" always;`, plus the same line for X-Content-Type-Options and X-Frame-Options; then reload nginx.

### WordPress and site builders

In WordPress, security plugins also set these headers; otherwise use the .htaccess lines above. On hosted systems such as Shopify or Wix you have no direct access to the headers; what remains is keeping apps and embedded scripts up to date.

### Replace old libraries

Usually an old theme or plugin brings jQuery or Bootstrap along. Search the page source (Ctrl+U) for jquery or bootstrap; the path names the theme or plugin. Update or replace it.

### Measure again

Reload the page and look at the response headers again, or check the address above once more.

## Questions

### Is this a penetration test?

No. We only read what every visitor gets on a normal visit and never try to get in. A missing header is not a vulnerability in itself but a missing protection.

### Why don't you report a missing Content Security Policy?

A CSP is missing on almost every website and cannot be set with one line: it has to know every source of your scripts. We only report what can be fixed right away. An existing CSP with frame-ancestors counts instead of X-Frame-Options.

### Does the GDPR require security headers?

Art. 32 GDPR requires appropriate technical measures to protect personal data but names no specific headers. Missing headers are therefore yellow in the report, as a security topic, not a legal question.

### Is the check free?

Yes, without sign-up and without a credit card. Every finding is in the report with where it was found; the steps to fix it come with your email, free for 14 days.

### Do you also check SPF, DKIM and DMARC?

Yes, your domain's email records are in the same report. They are also available on their own in the email check.

## What a scan shows

It reads the home page response, the certificate, the redirect from http to https, the versions of the loaded libraries and the cookies after the visit. The report names every missing header with the line to add. Only your domain's email records: [Email check](https://konformia.at/en/email-check).

Check your website for free

As of 27 October 2026. We name the reference so you can read it yourself; this is not legal advice.

## More guides

- [Cookies before consent: what ePrivacy requires](https://konformia.at/en/guides/cookies-before-consent)
- [Price information in web shops: unit price and shipping](https://konformia.at/en/guides/price-information-product-page)
- [European Accessibility Act checker for web shops (WCAG)](https://konformia.at/en/guides/web-shop-accessibility-check)
- [Cookiebot not working or not blocking?](https://konformia.at/en/guides/cookiebot-not-blocking)
- [Usercentrics not blocking?](https://konformia.at/en/guides/usercentrics-not-blocking)
- [Borlabs Cookie not blocking?](https://konformia.at/en/guides/borlabs-cookie-not-blocking)
- [Real Cookie Banner not blocking?](https://konformia.at/en/guides/real-cookie-banner-not-blocking)
- [Complianz not blocking?](https://konformia.at/en/guides/complianz-not-blocking)
- [Check your cookie banner yourself in three steps](https://konformia.at/en/guides/check-cookie-banner-yourself)
- [Google Fonts self-hosted but still loading?](https://konformia.at/en/guides/google-fonts-find-source)
- [Dark patterns in online shops: five patterns and the fix](https://konformia.at/en/guides/dark-patterns-online-shop)
- [EU withdrawal button 2026: what your shop needs](https://konformia.at/en/guides/withdrawal-button)
- [Unit price and the “order with obligation to pay” button](https://konformia.at/en/guides/unit-price-order-button)
- [GPSR: manufacturer information in your web shop](https://konformia.at/en/guides/gpsr-manufacturer-information)
- [Google Consent Mode v2 checker: test and set it up](https://konformia.at/en/guides/google-consent-mode-v2)
- [Cookie checker for websites: free, with the reject test](https://konformia.at/en/guides/cookie-check)