Try “SSH”, “passkeys”, “WordPress” or “Content-Security-Policy”.
Header Check · runs in your browser
Paste the HTTP response headers of your website and get a graded report on HSTS, Content-Security-Policy, cookies, Referrer-Policy and more, with fixes.
Get the headers with curl -sI https://your-domain or from the network panel of your browser’s developer tools. Analysed locally, never sent.
Read the background
Four web servers, one question: which one leaves the fewest gaps once it is running? We compare defaults, automatic HTTPS, configuration risk, attack surface and how fast fixes reach you.
Medium impact6 min
A padlock in the browser is the start, not the finish. This guide covers TLS 1.2 and 1.3, sensible ciphers, HSTS and preloading, and the shrinking certificate lifetimes that make automation mandatory.
High impact5 min
Six ways to run a website, scored on security process, extension risk, updates, support windows and attack surface. The right choice depends less on the code than on the routine you can keep.
High impact6 min
More tools
