Security Headers Scanner
Enter a URL to check which security-relevant HTTP headers it sends, such as Strict-Transport-Security, Content-Security-Policy, and X-Frame-Options, with a score and a plain-language explanation for each.
Enter a URL to check its HTTP security headers.
How to scan a site's HTTP security headers
Enter a URL to fetch its HTTP response headers and see which browser-side protections it turns on, and which ones it's missing.
Why this needs a server
Browsers deliberately block a page from reading most of another origin's response headers through JavaScript — that's a core part of the same-origin policy. Checking a site you don't control from the browser alone isn't possible, so this tool's backend makes the request instead and reports back only the headers, never the page's content.
What gets checked
Eight headers that consistently matter for transport security and browser-side hardening: Strict-Transport-Security, Content-Security-Policy, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy, Cross-Origin-Opener-Policy, and Cross-Origin-Resource-Policy. Each has a short explanation next to its result.
This is a starting checklist, not a full audit. A header being present does not confirm its value is well configured for your specific site — a Content-Security-Policy of "default-src *", for instance, counts as present here even though it provides little real protection.
Reading the grade
The score weighs headers by how much they typically matter: Strict-Transport-Security, Content-Security-Policy, and X-Content-Type-Options count for the most, X-Frame-Options, Referrer-Policy, and Permissions-Policy count for less, and the two Cross-Origin-* headers count for least. The grade is a rough summary, not a certification.
What this tool fetches, and what it does not
Only the response headers of the URL you enter are read; the page's body is never downloaded. Redirects are reported but never followed automatically, and requests to private, internal, or loopback addresses are refused before any request is made.
FAQ
Can I scan any URL, including internal or local addresses?
No. Requests to private, loopback, link-local, and other internal address ranges are blocked before any connection is made, so this cannot be used to probe your own internal network.
Does it follow redirects?
No. If the URL responds with a redirect, that redirect response's own headers are shown, and the destination is never automatically fetched.
Does a good grade mean the site is fully secure?
No. It means the checked headers are present. Header configuration is one layer of web security among many, and a present header can still be configured too loosely to be effective.
Why does it only work on the default HTTP/HTTPS port?
It keeps the tool focused on scanning real websites rather than becoming a general-purpose port prober.