About this tool
See the status, every response header, compression and caching of a URL, and check HSTS, CSP, X-Content-Type-Options, frame protection and more.
1CLIK requests the URL, follows redirects (each hop re-checked), and reads the final response headers. Security headers are graded one by one: HSTS needs at least six months, X-Content-Type-Options must be nosniff, and clickjacking protection can come from X-Frame-Options or CSP frame-ancestors.
Example: check Page URL = https://github.com.
Headers are only one layer of security. A good score does not mean the site is secure, and a missing header is not always a vulnerability.
Quick steps
- Enter the address of a public page or domain.
- Press Check. The 1CLIK server visits it, which can take a few seconds.
- Read each line — Good, Improve, Problem or Info — with a hint on what to fix.
1CLIK’s server fetches only the public address you enter. Private and internal addresses are refused, and results are cached for a few minutes, not saved to your account.
FAQ
How does the HTTP Headers & Security Headers Checker work?
1CLIK requests the URL, follows redirects (each hop re-checked), and reads the final response headers. Security headers are graded one by one: HSTS needs at least six months, X-Content-Type-Options must be nosniff, and clickjacking protection can come from X-Frame-Options or CSP frame-ancestors.
What should I keep in mind?
Headers are only one layer of security. A good score does not mean the site is secure, and a missing header is not always a vulnerability.
Why can the result differ from what I see in my browser?
The check sees what the server sends to 1CLIK, before any JavaScript runs. Sites can also answer automated requests differently, block them, or vary by country.