Question 1

Is the header checker really free?

Accepted Answer

Yes. Enter any public website and get a per-header report with a score out of 100. No email, no account, nothing stored about the URL you checked.

Question 2

Does a failing score mean the site is hacked?

Accepted Answer

No. Missing headers don't mean a breach — most small-business sites fail half of these checks. Headers are one layer of defense; they harden a site against entire classes of attack, but they're not proof of safety or of compromise.

Question 3

What's the single most important header to fix?

Accepted Answer

Content-Security-Policy. It declares exactly which scripts, styles, and images may load on the page, and it's the strongest single protection against cross-site scripting — the most common web attack.

Question 4

Do you store the URLs people check?

Accepted Answer

No. Only the response headers are read to compute the score — the page body is never downloaded — and the URL is never written anywhere. Only an anonymous run count is recorded.

Are your security headers actually there?

What it checks