./prontouso.com

SECURITY

Security Headers Scanner

Enter a URL to check which security-relevant HTTP headers it sends, such as Strict-Transport-Security, Content-Security-Policy, and X-Frame-Options, with a score and a plain-language explanation for each.

Tool statusUses server processing
Preview

Enter a URL to check its HTTP security headers.

How it works

  1. Enter your input

    Fill in the values, paste your text, or upload the file this tool works with.

  2. See results instantly

    Most tools update live as you type; a few use a single button. Either way, the result appears right on this page.

  3. Use your results

    Copy, download, or share what the tool produces — you're always in control of the output.

What this tool fetches, and what it does not — The URL you enter is sent to a ProntoUso server so it can request the site's public response headers for this scan. The page body is never downloaded, redirects are reported but not followed automatically, and private or internal addresses are refused. The URL and returned headers are not stored.

What is Security Headers Scanner?

Enter a URL to fetch its HTTP response headers and see which browser-side protections it turns on, and which ones it's missing.

UNDERSTAND THE TOOL

How to scan a site's HTTP security headers

Why this needs a server

Browsers deliberately block a page from reading most of another origin's response headers through JavaScript — that's a core part of the same-origin policy. Checking a site you don't control from the browser alone isn't possible, so this tool's backend makes the request instead and reports back only the headers, never the page's content.

What gets checked

Eight headers that consistently matter for transport security and browser-side hardening: Strict-Transport-Security, Content-Security-Policy, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy, Cross-Origin-Opener-Policy, and Cross-Origin-Resource-Policy. Each has a short explanation next to its result.

This is a starting checklist, not a full audit. A header being present does not confirm its value is well configured for your specific site — a Content-Security-Policy of "default-src *", for instance, counts as present here even though it provides little real protection.

Reading the grade

The score weighs headers by how much they typically matter: Strict-Transport-Security, Content-Security-Policy, and X-Content-Type-Options count for the most, X-Frame-Options, Referrer-Policy, and Permissions-Policy count for less, and the two Cross-Origin-* headers count for least. The grade is a rough summary, not a certification.

What this tool fetches, and what it does not

The URL you enter is sent to a ProntoUso server so it can request the site's public response headers for this scan. The page body is never downloaded, redirects are reported but not followed automatically, and private or internal addresses are refused. The URL and returned headers are not stored.

Frequently Asked Questions

Can I scan any URL, including internal or local addresses?

No. Requests to private, loopback, link-local, and other internal address ranges are blocked before any connection is made, so this cannot be used to probe your own internal network.

Does it follow redirects?

No. If the URL responds with a redirect, that redirect response's own headers are shown, and the destination is never automatically fetched.

Does a good grade mean the site is fully secure?

No. It means the checked headers are present. Header configuration is one layer of web security among many, and a present header can still be configured too loosely to be effective.

Why does it only work on the default HTTP/HTTPS port?

It keeps the tool focused on scanning real websites rather than becoming a general-purpose port prober.

Related Tools