Security Header Scanner
Check your website's security headers in seconds. Free, no signup required.
What this scanner checks
Security response headers are the cheapest defensive controls a web application can deploy — a few lines of configuration that instruct the browser to refuse entire classes of attack. The scanner fetches your homepage and grades the presence and correctness of the six headers that matter most: Content-Security-Policy, Strict-Transport-Security, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy.
Why headers are worth fixing first
A missing Content-Security-Policy is what turns a small stored-XSS bug into session theft. Missing X-Frame-Options or frame-ancestors is what makes a login page clickjackable. Missing HSTS lets an attacker on the network strip your HTTPS on the next visit. These are not theoretical — they are the exact gaps that turn a medium finding into a critical one in real assessments, and they are all visible from a single HTTP response.
What a scan does not cover
Headers are the surface layer. They say nothing about authorization logic, injection, business-logic abuse, or the hundred other ways an application actually gets breached. If your grade is A+ the headers are done — that is when the real testing starts. A manual assessment exercises the application the way an attacker does, which is what finds the flaws a scanner cannot see.
Scanner FAQ
Is the header scanner free?
Yes — completely free, no signup. Enter a URL and get a grade plus per-header recommendations in seconds.
Does a good header grade mean my site is secure?
No. Headers are a hardening layer, not a vulnerability assessment. They stop whole classes of browser-side attacks — clickjacking, MIME sniffing, downgrade attacks — but they do not find logic flaws, auth issues, or injection bugs.
What grade should I aim for?
A or A+. Anything below B means at least one meaningful protection is missing — usually CSP or HSTS, both of which are cheap to deploy.
Can I scan someone else's site?
The check only reads public HTTP response headers — the same data any browser sees on a normal page load. It is a passive observation, not an active test.