Check your security headers
A few response headers stop whole classes of attacks: downgrades to plain HTTP, clickjacking, cross-site scripting. Enter a page and get a grade, what each header does and the exact line to add.
What it checks
- HTTPS and Strict-Transport-Security (and whether max-age is long enough)
- Content-Security-Policy, including unsafe-inline and wildcard script sources
- Clickjacking protection (frame-ancestors or X-Frame-Options)
- X-Content-Type-Options, Referrer-Policy, Permissions-Policy and Cross-Origin-Opener-Policy
- Headers that reveal server or framework versions
Questions
Where do I add these headers?
In your web server or host settings (Apache .htaccess, nginx config, Vercel or Netlify config, Cloudflare rules), or with a security plugin on WordPress. The fix for each header shows the exact value to send.
Will a Content-Security-Policy break my site?
It can, if it blocks a script you use. Start with Content-Security-Policy-Report-Only, fix what it reports, then enforce it.
Is this a full security scan?
No, it checks one page's headers. A Vinny audit also checks TLS, exposed files, vulnerable JavaScript libraries, secret keys in scripts and open admin pages, and WordPress sites can use the free JustWhat Security Audit plugin.