Scan a website's HTTP security headers in one click. Get a grade for CSP, HSTS, clickjacking protection and the other headers, plus cookies, HTTPS redirect, version leaks and certificate, with a clear fix for every issue.
No site scanned yet
// one GET request, body not downloaded · private addresses blocked · results cached for 5 minutes
Security headers are the cheapest layer of web defence: a few lines in the server or CDN configuration block whole classes of attacks such as XSS, clickjacking, SSL stripping and MIME sniffing. They are also among the first things a pentester or an automated scanner reports, so checking them before an audit saves easy findings.
Enter a URL or a domain: https:// is added when missing.
Read the grade, then each header with its value and the problems found.
Add or fix the headers in your web server or CDN and scan again.
It requests the page like a browser, follows redirects and grades the final response: Content-Security-Policy, Strict-Transport-Security, X-Frame-Options or CSP frame-ancestors, X-Content-Type-Options, Referrer-Policy and Permissions-Policy. It also checks that http:// redirects to https://, the flags of every cookie, headers that leak software versions and the TLS certificate.
HSTS forces HTTPS, a Content-Security-Policy limits the damage of XSS, and X-Frame-Options or frame-ancestors stops clickjacking. X-Content-Type-Options: nosniff, a strict Referrer-Policy and a Permissions-Policy are quick wins that cost nothing to add.
A policy that allows 'unsafe-inline' scripts without a nonce or hash, 'unsafe-eval', or any host (*, https:) still lets injected scripts run. The checker reads the script-src (or default-src) directive and explains which part weakens it.
No. Browsers removed their XSS auditor and the header can even introduce issues; set it to 0 or remove it and rely on a Content-Security-Policy instead. Expect-CT and Public-Key-Pins are obsolete as well.
No. The server sends a GET request, reads the status and headers, and cancels the body. Private IP addresses and local hosts are blocked, and results are cached for 5 minutes.
Reading the public headers of a site is what every browser does, but only use the results for sites you own or are authorized to assess.