Free tool
Security headers check
Enter a hostname. We fetch the page from Frankfurt and list the security headers it sends and the ones it does not.
Which headers count?
Strict-Transport-Security, Content-Security-Policy, X-Content-Type-Options, X-Frame-Options, Referrer-Policy and Permissions-Policy. Each is one line in the server config and stops one class of attack.
Is a missing header a vulnerability?
Not by itself. It is a protection not switched on; whether it matters depends on what the page does. HSTS and X-Content-Type-Options are safe to add to almost any site.