Security headers on your client sites: HSTS, CSP and the rest
Security headers cost little and close whole classes of attacks, but they disappear easily: a host move, a new CDN or a cache plugin drops them without telling anyone.
Set up once, then nobody checks them again.
An .htaccess overwritten during a migration, a changed CDN rule: the headers you set are gone, and the site looks the same.
Reading them by hand with the browser tools is easy for one site. For fifty sites every month it isn't.
What we check.
Request to the home page
From our servers we read the headers the home page actually sends to visitors.
Compared with the rules
Strict-Transport-Security, X-Content-Type-Options, framing protection with X-Frame-Options or frame-ancestors, Content-Security-Policy, Referrer-Policy and Permissions-Policy.
What to do
Each result says which header to add and a starting value, such as
max-age=31536000for HSTS.
Want to try it on a real site? The 30-day trial needs no credit card.
Start free trialFrequently asked questions
Do you check every page?
No, the home page. Headers usually come from the server or the CDN and are the same across the site.
Can I add HSTS with preload right away?
Better not. The guidance suggests `max-age=31536000` once the whole site works on https, and `includeSubDomains` and `preload` only after checking every subdomain.
Goes well with
- 169 automatic configuration checks for WordPress, Joomla, Drupal and PrestaShopHidden admins, risky settings, exposed databases and files, with what to do.
- SSL certificate expiry monitoring, site by siteAlerts before expiry, and at once if the certificate is invalid.
- Cloaking detection: the page Googlebot gets compared with the one visitors getGooglebot, a visitor from Google and mobile compared, with an AI opinion.
- WordPress hardening, checked on every site, every dayFile editor, security keys, debugging, XML-RPC and forgotten tools.
Try it on your clients' sites.
Connect your first sites today and see what SitePing finds on them.
- Every Complete feature except backups
- Up to 10 sites
- No credit card needed to start
- At the end you choose a plan or move to Free, and nothing is charged
Already have an account? Log in. Prefer to look at one site first? Free read-only audit.