Web Plura

Free public URL tool

Security Headers Checker

Review public security header signals from a homepage response without presenting the result as a vulnerability scan.

Run SiteCheckSecurity guide

Problem, cause, fix, verify

Problem

Security header conversations often need a public evidence snapshot before teams decide whether hosting, CDN, theme, or application owners should adjust browser policies.

Audience

WordPress owners, developers, agencies, and security reviewers checking visible browser policy headers.

First check

Enter a public HTTP or HTTPS URL. Private, localhost, internal, credentialed, and unsupported targets are blocked by the same SiteCheck-style URL validation used by the speed tool.

Verify

Use the result to open a focused support ticket or implementation task with the exact URL, final status, observed headers, and the policy goal.

Editorial trust

Published
Updated
Content type
Tools
Review editorial policy

On this page

Decision Support

Security header conversations often need a public evidence snapshot before teams decide whether hosting, CDN, theme, or application owners should adjust browser policies.

For: WordPress owners, developers, agencies, and security reviewers checking visible browser policy headers.

Use The Tool

What this tool helps you check

Inputs

Enter a public HTTP or HTTPS URL. Private, localhost, internal, credentialed, and unsupported targets are blocked by the same SiteCheck-style URL validation used by the speed tool.

Output

The checker reports visible browser policy headers such as Content-Security-Policy, Strict-Transport-Security, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, and Permissions-Policy.

How To Read It

Missing headers are review prompts, not proof of compromise. Confirm the intended policy with the host, CDN, and application owner before making changes that could break embeds, analytics, checkout, or admin workflows.

Follow-Up

Use the result to open a focused support ticket or implementation task with the exact URL, final status, observed headers, and the policy goal.

This reviews public response headers only. It is not a vulnerability scan, penetration test, or security certification.

Limitations

Use the result as planning guidance

  • Uses the existing low-cost HTTP-lite public URL check.
  • Reviews public response headers only.
  • Not a vulnerability scan, penetration test, or security certification.