Bulk Security Headers Checker (HSTS, CSP)
Security headers are a cheap, configuration-level hardening layer that protects visitors even when the application code has a flaw: HSTS stops protocol downgrade and cookie theft on open Wi-Fi, X-Content-Type-Options…
More about this tool
prevents content-type sniffing attacks, Content-Security-Policy blocks most cross-site scripting, X-Frame-Options fights clickjacking, while Referrer-Policy and Permissions-Policy keep private data from leaking to third parties. This bulk checker walks a whole list of domains and reports which of the six key headers each site actually sends, with the full header values available in the row details. It also verifies the two transport basics: that the site works over HTTPS at all, and that plain HTTP redirects to HTTPS before anything else is served. Sites below your own threshold of present headers are highlighted, which makes the report a ready-made checklist for server and CDN configuration work — and a way to verify the headers actually shipped after deploying them.
How it works
- Paste up to 100 items, one per line. Duplicates are removed automatically.
- If a line contains a full URL, only its host name is used.
- The check runs in the background; the results page shows live progress.
- Filter the report by status code and export it to CSV.
Rate limit: 5 jobs per hour from one IP address. Results are stored for 7 days.
FAQ
Are all six headers mandatory?
No. HSTS, X-Content-Type-Options and a sane Referrer-Policy are inexpensive defaults every site can afford; CSP is the most powerful but the hardest to adopt on legacy front-ends — a report failing on CSP alone is not an emergency. The threshold in the form lets you set your own bar.
Why does HEAD hit some sites with 405?
A few servers reject HEAD requests. That is fine for this check: the response still carries all security headers, and the tool reads them from whatever status the server returns — the status itself is shown in the report.
HSTS on a dev subdomain — safe?
Careful: HSTS with includeSubDomains pinned at the apex makes every subdomain HTTPS-only for the max-age period, and browsers remember it. Check which value the site actually sends — the full header is shown in the row details.
What counts as "redirects to HTTPS"?
A plain http:// request for the domain must come back with a 3xx redirect whose target is on https — either directly to the same URL or through a canonical host hop (http://site → https://site). Everything else counts as no redirect.
Can this break my site?
The check is read-only: it sends requests and reads headers, changing nothing. Deploying the headers themselves is your separate task — and the report lets you re-run the list afterwards to confirm each header actually went live.
Other tools
Bulk Domain Blacklist Checker (DNSBL)
Free bulk blacklist checker: paste domains and check them against Spamhaus, Barracuda, SpamCop, SORBS and SURBL in one run. Instantly see if your domain or IP is blacklisted. CSV export.
Accepts a list of domainsBulk DNS Records Lookup (A, AAAA, MX, NS, TXT)
Free bulk DNS lookup with a custom DNS server option: paste domains and get A, AAAA, CNAME, MX, NS, TXT, SOA and SRV records grouped by type, one record per line with TTL, MX priorities, copy buttons and CSV export.
Accepts a list of domainsBulk Domain Expiration Checker (RDAP)
Free bulk domain expiry checker via RDAP with automatic WHOIS fallback: paste a list of domains and get the registrar, registration and expiration dates and days left for each. Domains expiring within 30 days are highlighted. Registry answers are cached for 24 hours. CSV export included.
Accepts a list of domainsBulk URL Status Checker
Free bulk URL status checker: paste up to 100 URLs and get HTTP status codes, redirect chains, final URLs and response times. Export the results to CSV.
Accepts a list of URLsBulk Indexability Checker (noindex, X-Robots-Tag, canonical)
Free bulk indexability checker: paste URLs and detect noindex meta tags, X-Robots-Tag headers, nofollow, canonical and hreflang. Export the crawl audit to CSV.
Accepts a list of URLsBulk Mail Records Checker (SPF, DKIM, DMARC, MX)
Free bulk mail records checker: paste domains and audit SPF, DKIM, DMARC policies and MX records. Make sure your domains can send mail and cannot be spoofed. CSV export.
Accepts a list of domainsBulk Meta Tags Checker (Title, Description, H1)
Free bulk meta tags checker: paste URLs and get Title, meta description, H1 and heading counts with length checks and duplicate detection. Export the SEO audit to CSV.
Accepts a list of URLsBulk Open Graph & Twitter Cards Checker
Free bulk Open Graph checker: paste URLs and audit og:title, og:description, og:image, twitter:card and more social preview tags. Export the report to CSV.
Accepts a list of URLsBulk Outgoing Links & Broken Links Checker
Free bulk outgoing links checker: paste URLs to count external and internal links, dofollow vs nofollow, and find broken links (404, 5xx, dead domains). Export the audit to CSV.
Accepts a list of URLsBulk robots.txt Checker
Free bulk robots.txt checker: paste a list of domains and see the status of /robots.txt, redirect count, file size, the number of Sitemap directives and whether all crawlers are blocked. CSV export included.
Accepts a list of domainsBulk SSL Certificate Checker
Free bulk SSL certificate checker: paste a list of domains and instantly see the certificate subject, issuer, hostname match, expiry date and days left before renewal. Find expiring certificates before they become incidents. CSV export included.
Accepts a list of domainsBulk TTFB & Speed Checker
Free bulk TTFB checker: paste a list of URLs and measure time to first byte, total response time and HTML size for each page. Export the report to CSV.
Accepts a list of URLs