Free Security Headers & Email Record Checker

Website security headers checked

Security headers are short instructions your server sends with each page. Visitors never see them, but their browsers follow them. Here's what the checker reads and what good looks like:

Email records checked: SPF, DKIM and DMARC

Anyone can put your domain in the "From" line of an email. These DNS records are how inbox providers tell your real email from fakes, and they affect whether your own email lands in the inbox or in spam:

SPF has a hard limit: evaluating it may take at most 10 DNS lookups, counting every include:, a, mx and redirect inside the services you include. Go over and SPF fails for every message, so the checker follows your includes and counts them.

Real example: our own domain

We ran the checker on cmoowls.com. It passed the essentials: a valid certificate from Google Trust Services, a permanent http to https redirect, HSTS, clickjacking protection, nosniff and a strict-origin-when-cross-origin Referrer-Policy. SPF ends in ~all, and a DKIM key was found on the google selector.

It also found three things to improve, and we're not hiding them: our Content-Security-Policy still allows inline scripts, we don't send a Permissions-Policy, and our DMARC policy is p=none, which collects reports but doesn't yet block fakes. That's a typical result for a young site, and exactly the kind of list this tool is for.

How to add the missing pieces

Security headers

• On Cloudflare: turn on Always Use HTTPS and HSTS under SSL/TLS, and add the other headers with a response header transform rule.
• On nginx: add the headers in your server block (example below), then reload.
• On Apache: use Header always set lines in your configuration or .htaccess.
• On WordPress or a hosted builder: many hosts have a security headers setting; otherwise a well-maintained security plugin can add them.

add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;

Add a Content-Security-Policy last, starting with Content-Security-Policy-Report-Only, so you can see what it would block before it blocks anything.

Email records

All three are TXT records you add in your domain's DNS settings. Your email provider gives you the exact SPF include and DKIM key; DMARC you write yourself:

yourdomain.com          TXT  "v=spf1 include:_spf.google.com ~all"
_dmarc.yourdomain.com   TXT  "v=DMARC1; p=none; rua=mailto:[email protected]"

1. Add SPF with your email provider's include (one record only).
2. Turn on DKIM in your email provider and publish the key it gives you.
3. Add DMARC at p=none with a reporting address, and read the reports for a few weeks.
4. Fix any legitimate senders that fail (newsletter tools, invoicing, your website's contact form).
5. Move to p=quarantine, then p=reject once real email consistently passes.

What this scan can't see

• Headers on other pages. We read your homepage; other pages and files can send different headers.
• DKIM on uncommon selectors. We try 22 common ones; your provider may use another.
• Whether your email is delivered. Good records help a lot, but delivery also depends on what you send and to whom.
• Vulnerabilities in your site. This isn't a penetration test; it checks settings, not code.

Your domain's trust settings on one map

Security settings are one part of a wider website audit. To check that http, www and old addresses all redirect correctly, use the Redirect Checker; to check a suspicious link someone sent you, use the Link Safety Checker.