TechAtelier
INFRACHECK

Test your website’s HTTP security headers

Does your website tell browsers how to protect visitors? Check its HTTP security headers and identify missing or overly permissive policies with InfraCheck.

No account required. Passive checks of public information, without access to your hosting.

You go straight to the domain’s InfraCheck report. Open the HTTP section for security headers; the report also includes DNS, TLS and email checks.

Which security headers are checked?

HSTS — Strict-Transport-Security

Tells browsers to use HTTPS for a defined period. InfraCheck examines the duration and subdomain coverage, among other signals. Only enable subdomain coverage when all your subdomains support HTTPS.

CSP — Content-Security-Policy

Defines which resources browsers may load and limits the impact of some content injection attacks. Its presence alone is not enough: broad sources or missing directives can weaken protection.

X-Content-Type-Options

The nosniff value prevents browsers from guessing a content type different from the declared type, particularly for scripts and stylesheets.

Referrer-Policy

Controls how much of the originating URL is sent with requests. An appropriate policy limits information disclosed to other websites.

Permissions-Policy

Restricts access to certain browser features. InfraCheck checks rules for the camera, microphone and geolocation in particular; support also depends on the browser.

How do you use the results?

  1. Enter the public domain you want to check, such as example.com.
  2. Start the free analysis to open the InfraCheck report and its HTTP section.
  3. Review alerts and recommendations, adapt your server or CDN configuration, then run the test again.

What this test can tell you

The analysis checks public responses observed for the domain, not every page or authenticated area. Headers may vary by route, server or CDN. A missing header is a signal to investigate; a good result does not guarantee the absence of vulnerabilities.

Test changes before deploying them: an overly restrictive CSP can block legitimate resources. Content-Security-Policy-Report-Only lets you observe violations before enforcing the policy.

One domain, actionable results

Identify HTTP protections to improve and find the other domain checks in InfraCheck.

Analyze for free

Updated September 17, 2026.