How to Check Missing Security Headers on Your Website

When a website is exposed to the public, the first thing most site owners think about is content and design. Security often comes later, after a breach or a warning from a browser. Missing HTTP security headers are a common blind spot that can leave a site vulnerable to click‑jacking, cross‑site scripting, and other attacks. If you’ve ever typed “how to check security headers on my website” into a search engine, you’re probably looking for a straightforward way to identify which headers are absent and how to add them.

In this guide we’ll walk through:

What security headers are and why they matter.

Simple methods to check security headers on my website using both command‑line tools and online services.

How to interpret the results and prioritize fixes.

Practical steps to add the missing headers for Apache, Nginx, and cloud‑based platforms.

By the end you’ll have a clear, actionable plan to harden your site’s HTTP response and improve its standing with browsers and security scanners.

---

Why Security Headers Matter

Security headers are part of the HTTP response that instruct browsers how to handle the content they receive. Unlike encryption (TLS) or authentication mechanisms, these headers are lightweight directives that can block common attack vectors without changing your site’s code.

| Header | Primary Protection | Typical Value |

|--------|-------------------|----------------|

| Content‑Security‑Policy (CSP) | Mitigates XSS and data injection | default-src 'self'; |

| X‑Frame‑Options | Prevents click‑jacking | DENY or SAMEORIGIN |

| X‑Content‑Type‑Options | Stops MIME‑type sniffing | nosniff |

| Referrer‑Policy | Controls referrer data sent to other sites | strict-origin-when-cross-origin |

| Strict‑Transport‑Security (HSTS) | Forces HTTPS connections | max-age=31536000; includeSubDomains |

| Permissions‑Policy | Restricts use of browser features | geolocation=() |

| Expect‑CT | Enforces Certificate Transparency | max-age=86400, enforce |

If any of these are missing, browsers fall back to default, less‑secure behavior. That can lead to warnings in Chrome’s console, reduced SEO rankings, and, more importantly, exposure to exploit techniques that are otherwise easy to block.

---

How to Check Security Headers on My Website – Quick Methods

1. Using Browser Developer Tools

Most modern browsers let you inspect response headers without leaving the page.

Open the page you want to test.

Press F12 (or right‑click → Inspect).

Go to the Network tab and reload the page.

Click the first request (usually the document) and look under Headers → Response Headers.

You’ll see a list of all headers sent by the server. If you don’t see the ones from the table above, they’re missing.

Pros: No installation required.

Cons: Manual, only shows one page at a time, and you have to repeat for each endpoint.

2. Curl Command (Command‑Line)

For developers comfortable with a terminal, curl offers a fast way to fetch headers:

`bash

curl -I https://example.com

The -I flag tells curl to perform a HEAD request and print only the response headers. Look for the security header names in the output.

You can also pipe the result into grep to filter:

`bash

curl -I https://example.com | grep -i "content-security-policy"

Pros: Scriptable, works on any OS with curl.

Cons: Only checks a single URL; you need to run it for each sub‑page or API endpoint you care about.

3. Online Header Checkers

If you prefer a visual report, there are several free web‑based tools. One that aligns perfectly with our needs is the Korrali Web Security Headers Checker. By entering your domain, the service performs a full request, follows redirects, and returns a concise list of present and missing headers.

Steps:

Visit the checker at .

Enter your full URL (e.g., https://example.com).

Click Start Check.

Review the results: present headers are highlighted, missing ones are listed with recommended values.

The tool also shows redirect chains, TLS/SSL details, and page metadata, giving a broader view of your site’s health.

Pros: No installation, handles redirects, provides actionable suggestions.

Cons: Relies on an external service; may have rate limits for very large scans.

4. Automated Scanners (CI/CD Integration)

For agencies that need to monitor many client sites, integrating a header check into a CI pipeline can catch regressions early. Tools like OWASP ZAP or Nikto have modules to validate response headers. While setting them up requires more effort, the payoff is continuous compliance.

Pros: Automated, works across many sites, can be combined with other security tests.

Cons: Requires configuration and maintenance.

---

Interpreting the Results – Prioritising Fixes

Not all headers carry the same weight. Here’s a quick guide to decide what to fix first:

HSTS – If you serve over HTTPS, HSTS is critical. It prevents downgrade attacks and forces browsers to use secure connections for the defined period. Add it before anything else.

X‑Frame‑Options – Click‑jacking is a low‑effort attack that can have high impact. Enable it early, especially for pages with forms.

X‑Content‑Type‑Options – Simple to add and blocks a class of MIME‑type attacks. Do this next.

CSP – Provides the strongest protection against XSS, but can be complex. Start with a “report‑only” mode to collect violations before enforcing.

Referrer‑Policy – Improves privacy and prevents leakage of sensitive URLs.

Permissions‑Policy – Fine‑tune access to features like geolocation or camera. Good for privacy‑focused sites.

Expect‑CT – Useful if you manage certificates yourself; otherwise optional.

When you receive a report from the Korrali checker, note which headers are missing, then follow the order above to address them systematically.

---

Adding Missing Headers – Practical Steps

Below are configuration snippets for the most common web servers. Replace example.com with your domain and adjust values to match your security policy.

Apache (httpd.conf or .htaccess)

`apache

Enforce HTTPS

Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"

Prevent click‑jacking

Header always set X-Frame-Options "DENY"

Stop MIME sniffing

Header always set X-Content-Type-Options "nosniff"

Referrer policy

Header always set Referrer-Policy "strict-origin-when-cross-origin"

Permissions policy (example: disable geolocation)

Header always set Permissions-Policy "geolocation=()"

Content Security Policy (report‑only first)

Header always set Content-Security-Policy-Report-Only "default-src 'self'; script-src 'self' https://apis.google.com; object-src 'none'; report-uri https://example.com/csp-report"

Place these directives in the appropriate virtual host block or .htaccess file. After saving, reload Apache:

`bash

sudo systemctl reload apache2

Nginx (nginx.conf or site‑specific file)

`nginx

add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

add_header X-Frame-Options "DENY" always;

add_header X-Content-Type-Options "nosniff" always;

add_header Referrer-Policy "strict-origin-when-cross-origin" always;

add_header Permissions-Policy "geolocation=()" always;

add_header Content-Security-Policy-Report-Only "default-src 'self'; script-src 'self' https://apis.google.com; object-src 'none'; report-uri https://example.com/csp-report" always;

Reload Nginx to apply:

`bash

sudo nginx -s reload

Cloud Platforms (AWS CloudFront, Azure Front Door, Cloudflare)

Most CDN or edge platforms allow you to add custom response headers via their UI.

AWS CloudFront: Create a Response Header Policy and attach it to your distribution. Add the same header names and values as above.

Azure Front Door: Use Rules Engine → Modify Response Header actions.

Cloudflare: Under Rules → Transform Rules you can set Response Header actions, or enable the built‑in Security Headers feature if available.

When using a CDN, ensure that the headers are not stripped by the origin server. Test the final response with the Korrali checker to confirm they are present after the CDN layer.

---

Verifying the Fixes

After updating configuration, repeat the check:

Run curl -I https://example.com or use the browser dev tools to see the new headers.

Run the Korrali Web Security Headers Checker again. The missing list should shrink, and each header should display its current value.

If a header still doesn’t appear, double‑check:

That the server block you edited actually serves the domain (virtual host mismatch).

Cache settings on CDNs or reverse proxies that might serve stale responses.

Syntax errors in the configuration files (Apache will log syntax errors; Nginx will refuse to reload).

---

Ongoing Monitoring

Security headers can be unintentionally removed when you update server software, change a CDN configuration, or deploy a new application version. Setting up regular monitoring prevents regression.

Korrali Web offers ongoing monitoring as part of its paid plan. It can alert you via email or webhook whenever a header disappears.

For free, you can schedule a cron job that runs curl for each site and compares the output against a baseline file.

Many CI tools (GitHub Actions, GitLab CI) can run a header‑check script on each pull request, failing the build if a required header is missing.

---

Conclusion

Checking and fixing missing security headers is a low‑cost, high‑impact step to protect your website. By using simple tools—browser dev panels, curl, or the free Korrali Web Security Headers Checker—you can quickly identify gaps. Then, follow the server‑specific snippets to add the missing directives, verify the changes, and put a monitoring process in place to keep the headers intact over time.

Secure headers are part of a broader security posture that also includes TLS configuration, regular vulnerability scanning, and safe coding practices. Treat them as a baseline requirement; once they’re in place, you’ll have one less avenue for attackers to exploit.

Ready to see which headers your site is missing? Check your website free at [web.korrali.com](https://web.korrali.com/checkers/security-headers-checker) and start tightening your HTTP response today.