Security headers checker
Read HSTS, Content-Security-Policy, clickjacking protections, cookie flags and leftover fingerprints from the live HTTP response. One GET from our server.
What this headers check actually does
We fetch the URL (following redirects), then score the security headers on the final response. Missing HSTS, CSP, nosniff or clickjacking protection fails. Permissions-Policy and COOP are optional — missing is info, not a fail.
This is not a penetration test and it does not execute JavaScript. Cookie values are never shown; only names and flags. Pintelly's main product is the feedback widget.
What we look at
HSTS
Present on HTTPS, with max-age of at least 180 days. Shorter max-age is a warning.
CSP
A Content-Security-Policy must exist. unsafe-inline / unsafe-eval is a warning, not a silent pass.
Clickjacking
X-Frame-Options DENY/SAMEORIGIN, or CSP frame-ancestors.
Cookies
On HTTPS, Set-Cookie without Secure fails. SameSite missing is a warning. Values are dropped.
How it works
Paste a public URL
DNS is resolved; private IPs are refused.
We GET the final response
Redirects are followed. The body is discarded. Five checks per host per day.
A score and the raw headers
Only the security headers are shown, plus cookie flags.
Frequently asked questions
Is this checker free?+
Yes. Five checks per host per day. No account.
Do you store the response?+
No. Headers are scored in memory and discarded.
Why is Permissions-Policy not a fail?+
It is useful and still unevenly deployed. We show it as info so a missing header does not tank a site that already has HSTS and CSP.
Is this securityheaders.com?+
Same idea, our scoring. We do not copy their letter grades or their paid crawl.
Can I check any site?+
Public HTTP(S) HTML or any 2xx/3xx that returns headers. Localhost is refused.
Other free checks
SEO checker
On-page score, headings, links, SSL, headers and the redirect chain — one HTML fetch.
SSL checker
Certificate chain, key, cipher, and whether TLS 1.0/1.1 are still on.
Redirect checker
Hop-by-hop chain, HTTPS upgrades, 301 vs 302.
Feedback Widget
Pintelly's main product: visitors pin what is broken, with a screenshot.
Headers are a snapshot. Visitors still find the rest.
The checker is free. The feedback widget is how agencies catch what is actually broken — on the page, with a screenshot.