Security Headers
Check important HTTP security headers.
All key headers
CSP, HSTS, X-Frame-Options, and more, checked at once.
Missing header flags
Clearly shows what's absent and why it matters.
Grade breakdown
See exactly which headers helped or hurt your score.
Instant results
One request, full header analysis.
How it works
HTTP security headers — Content-Security-Policy, Strict-Transport-Security (HSTS), X-Frame-Options, X-Content-Type-Options, and others — tell the browser how to behave defensively when rendering your site. This scan checks which ones are present and correctly configured.
Most of these headers take a single server config line to add, yet a large share of sites still ship with none of them — leaving basic, well-known browser protections turned off for no reason.
Related reading
Frequently asked questions
Which header should I fix first if I can only do one?
Content-Security-Policy generally has the biggest real-world impact against XSS, though Strict-Transport-Security is the fastest to add correctly if your site is already fully on HTTPS.
My headers look correct in my server config — why does the scan disagree?
Check for a CDN or reverse proxy in front of your server that might be stripping or overriding headers before the response reaches visitors — the scan sees what actually arrives in the browser, not your origin server's raw config.
Related tools
CSP Generator
Build a Content-Security-Policy header to help prevent XSS.
CORS Misconfiguration Checker
Catch origin-reflection and wildcard + credentials CORS mistakes.
Cookie Security Scanner
Check cookies for missing Secure, HttpOnly & SameSite flags.
Technology Detector
Detect CMS, Framework, CDN, Server & Analytics