Purlock
Free tool · Security headers checker

How well is your site locked down?

A few response headers stop whole types of attack, and many sites are missing them. Get a grade from A to F, with the exact line to add for each one.

Try:

Free, with no account needed.

What it checks

What you get from the security headers checker

  • A grade from A to F

    A quick score you can share with your team.

  • HSTS and HTTPS

    Whether browsers are made to use a secure connection.

  • Content Security Policy

    Whether injected scripts are limited, and if your policy is weak.

  • Clickjacking

    Whether other sites can hide yours in a frame.

  • Cookies

    Whether they're sent securely, and protected from other sites.

  • The fix

    The exact header to add, ready to copy.

For developers

Three lines from your own code

Every tool is also an API, with one simple answer format. Keep your key on your server.

JavaScript

const res = await fetch("https://www.purlock.com/v1/tools/security-headers-checker?target=example.com", {
  headers: { authorization: `Bearer ${process.env.PURLOCK_API_KEY}` },
});
const report = await res.json();

Prompt for Cursor or Lovable

Add a call to the Purlock Security headers checker API on the server side of this app. Send GET https://www.purlock.com/v1/tools/security-headers-checker?target=VALUE with the header "Authorization: Bearer" and the PURLOCK_API_KEY environment variable. The JSON answer has status ("good", "attention" or "bad"), headline, checks (each with level, title, detail, fix) and data. If the call fails or times out after 3 seconds, carry on as if it wasn't there. Never put the API key in client code.

Free plan: 100 calls a month. Individual: 5,000. Business: 25,000.

FAQ

Questions, answered

What are security headers?
Short instructions your site sends with every page, telling browsers how to protect your visitors. They take minutes to add, and stop whole types of attack.
Does a good grade mean my site is secure?
No. It means these protections are switched on. There's far more to security, but missing headers are often the first thing a security review asks about.
Will adding them break my site?
Most won't. Content Security Policy can, so start it in report only mode and watch what it would block.

More free tools

Use it from your own code

Get a free API key with 100 calls a month. No card needed.

Get your API key