Check Headers is a web-based tool that helps you quickly inspect and evaluate the HTTP security headers of any website. Simply enter a URL, and Check Headers will retrieve and analyze the site's headers, providing a comprehensive report that includes:
✅ Presence of essential security headers like Content-Security-Policy, Strict-Transport-Security, X-Frame-Options, and more
🛡 A security grade from A+ to F, based on missing or misconfigured headers
⚠ Detection of unsafe Content-Security-Policy (CSP) configurations
📋 A full list of received headers and their values
❌ Warnings for potentially risky headers like Server or X-Powered-By
🔍 Insight into missing CSP directives with helpful explanations
Whether you're a developer, security professional, or website owner, Check Headers makes it easy to spot weaknesses and improve your site's HTTP header security.
Install the .NET 10 SDK, then run these commands from the repository root:
dotnet restore CheckHeaders.slnx
dotnet build CheckHeaders.slnx -c Release
dotnet run --project src/CheckHeaders --launch-profile httpOpen http://localhost:5213. To start the Aspire dashboard and app together, use
dotnet run --project src/CheckHeaders.AppHost.
The report uses a GET request and reads response headers without downloading the body. It shows the requested and final URLs, response status, a fixed UTC response timestamp, and DNS addresses for the final hostname. DNS addresses do not identify the actual connected server. TLS certificate validation remains enabled.
The grade is an application heuristic: A+, A, B, C, D, E, and F correspond to 6, 5, 4, 3, 2, 1, and 0 basic header checks passed. Header values, CSP script/object restrictions, and framing protection are evaluated; restrictive CSP frame-ancestors can replace X-Frame-Options. CORS and software identification are contextual notes. The grade does not certify website security or fully emulate browser policy enforcement. Redirect/error responses and non-HTML responses are identified separately.
dotnet test tests/CheckHeaders.Tests/CheckHeaders.Tests.csprojTo include real HTTP integration cases, start the controlled fixtures in one terminal:
postman simulation run postman/simulations/headers.sim.yaml --port 4019 --no-historyThen run in another terminal:
$env:CHECKHEADERS_SIMULATION_URL = 'http://localhost:4019/site'
dotnet test tests/CheckHeaders.Tests/CheckHeaders.Tests.csprojThe fixtures cover redirects, multiple CSP fields, and an HTTP 503 response. If the Postman dataset daemon cannot start on Windows, run the same fixture directly:
$env:PORT = '4019'
node postman/mocks/header-fixtures/default.jsWithout CHECKHEADERS_SIMULATION_URL, HTTP integration cases are explicitly skipped.
