Security Headers Inspector FREE
Check your HTTP security headers and get a grade with clear, actionable guidance on what to fix.
What a header scan proves
This reads the response, not your configuration
The grade reflects the headers this one request received, on this one URL, through whatever proxy or CDN sits in front of it. A different path or route can send different headers. Advice on HSTS and CSP is deliberately conservative: a long max-age or a narrow policy can take a site down if it is applied without checking the whole hostname tree first.
FAQ
Why is a header marked "Not set" instead of "Missing"?
Critical headers are reported as Missing; recommended ones as Not set. The distinction matters because the second group is often a deliberate choice, while the first almost never is.
Should I just copy a strict CSP from somewhere?
No. A Content-Security-Policy that does not match how your page actually loads scripts and styles will break the page rather than protect it. Start in report-only mode, read the violations, then enforce.
Why is X-Frame-Options shown as covered when it is absent?
Because a CSP frame-ancestors directive already governs framing, and browsers honour it. Adding the older header on top changes nothing, so the row is credited instead of flagged.
Does a good grade mean the site is secure?
No. Headers are one layer. They do nothing about authentication, access control, dependency vulnerabilities or the application logic itself.
Cybersecurity Basics for Business Websites and Web Applications
Most incidents are not sophisticated attacks. They are old problems, outdated software, reused passwords, exposed admin panels, that never got addressed. These are the fundamentals that prevent the majority of trouble.
HTTP Security Headers: CSP, HSTS, Permissions Policy and a Complete Configuration
HTTP security headers let a server tell the browser how scripts may be loaded, whether a page may be embedded, which device capabilities may be used, how much referrer information should be sent, how MIME types must be interpreted and whether the site may ever be reached over plain HTTP. A well-designed policy reduces the impact of several classes of attacks, including cross-site scripting, clickjacking, MIME confusion, XS-Leaks and unsafe cross-origin embedding.
Fortify vs Checkmarx One vs Veracode vs Snyk vs GitHub Code Security vs Semgrep: which enterprise AppSec platform should you choose in 2026?
An enterprise asks for “one security scanner”, but the real requirement normally contains several independent problems:
Need help improving your security?
We can help you implement the best security practices and secure your web applications.