Security Headers Scanner
Grade a site’s HSTS, CSP, X-Frame-Options, and other security headers with a fix note for each.
About the Security Headers Scanner
Security Headers Scanner fetches a URL and grades the HTTP response headers that browsers use to protect visitors: Strict-Transport-Security, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, and the two cross-origin isolation headers. You get a letter grade, a score out of 100, and a plain note for each header explaining what is missing or weak.
The grader looks at values, not just presence. A Strict-Transport-Security header with a short max-age earns partial credit, and a Content-Security-Policy that allows unsafe-inline or unsafe-eval is flagged rather than passed. Framing protection is accepted from either X-Frame-Options or a CSP frame-ancestors directive. Value checks are heuristics, so treat the grade as a prompt to review rather than an audit.
The request comes from our server and follows redirects, so the result reflects the final page. To see every header and the redirect chain, use the HTTP Header Checker. For the certificate and DNS side of the same site, run Domain X-ray.
Reach the developers and engineers who use these tools every day.
Frequently asked questions
How is the grade calculated?
Out of 100: Strict-Transport-Security 25, Content-Security-Policy 25, framing protection 10, X-Content-Type-Options 10, Referrer-Policy 10, Permissions-Policy 10, and 5 each for the two cross-origin headers. Weak values earn partial credit.
Why does a missing header matter if my site works fine?
These headers are instructions to the browser that limit damage when something else goes wrong, such as clickjacking, mixed content, or injected scripts. They cost nothing to add and do not change how the page looks.
Why was my Content-Security-Policy marked as a warning?
A policy that allows unsafe-inline, unsafe-eval, or a wildcard default source still permits much of what a CSP is meant to block. Moving to nonces or hashes removes the need for unsafe-inline.
Does the scan check the page after JavaScript runs?
No. It reads the headers of the HTTP response only. Meta tag policies and headers added by scripts are not seen.
Is the URL I enter stored?
No. Our server fetches the page, grades the headers, and returns the result without logging or persisting the URL.