Coverage by protection family
How much of each defence area is actually enforced.
Charts appear here once you run an analysis.
Security Headers Inspector FREE
Check your HTTP security headers and get a grade with clear, actionable guidance on what to fix.
Free to use
No registration
Privacy-first
Enter a website URL to scan
All checks are performed from our servers. We do not store or share your data.
Visual analytics
Coverage, strictness and the path in
The response headers this scan received, grouped the way an attacker would look at them.
Risk distribution
How the graded headers landed across good, weak and absent.
Charts appear here once you run an analysis.
Strictness per header
Enforced, present but weakened, or not set at all.
Charts appear here once you run an analysis.
Redirect path
The hops this scan followed, and whether each one was encrypted.
Charts appear here once you run an analysis.
Use cases
When to scan headers
Header configuration drifts quietly. These are the moments it usually breaks.
After a proxy or CDN change
Headers are often added at the edge. Move the edge and they can silently disappear.
Before tightening a policy
See the current value before you raise max-age or narrow a CSP, so the change is deliberate rather than hopeful.
Reviewing a vendor or a subdomain
A quick, external read of what a host actually sends, with no access to its configuration required.
Scope and limits
What a header scan proves
Headers describe intent. Whether the intent is enough depends on the application behind them.
This reads the response, not your configuration
The grade reflects the headers this one request received, on this one URL, through whatever proxy or CDN sits in front of it. A different path or route can send different headers. Advice on HSTS and CSP is deliberately conservative: a long max-age or a narrow policy can take a site down if it is applied without checking the whole hostname tree first.
Help
FAQ
What people ask once a grade appears.
Why is a header marked "Not set" instead of "Missing"?
Critical headers are reported as Missing; recommended ones as Not set. The distinction matters because the second group is often a deliberate choice, while the first almost never is.
Should I just copy a strict CSP from somewhere?
No. A Content-Security-Policy that does not match how your page actually loads scripts and styles will break the page rather than protect it. Start in report-only mode, read the violations, then enforce.
Why is X-Frame-Options shown as covered when it is absent?
Because a CSP frame-ancestors directive already governs framing, and browsers honour it. Adding the older header on top changes nothing, so the row is credited instead of flagged.
Does a good grade mean the site is secure?
No. Headers are one layer. They do nothing about authentication, access control, dependency vulnerabilities or the application logic itself.
Cybersecurity Basics for Business Websites and Web Applications
Most incidents are not sophisticated attacks. They are old problems, outdated software, reused passwords, exposed admin panels, that never got addressed. These are the fundamentals that prevent the majority of trouble.
Read article
HTTP Security Headers: CSP, HSTS, Permissions Policy and a Complete Configuration
HTTP security headers let a server tell the browser how scripts may be loaded, whether a page may be embedded, which device capabilities may be used, how much referrer information should be sent, how MIME types must be interpreted and whether the site may ever be reached over plain HTTP. A well-designed policy reduces the impact of several classes of attacks, including cross-site scripting, clickjacking, MIME confusion, XS-Leaks and unsafe cross-origin embedding.
Read article
Fortify vs Checkmarx One vs Veracode vs Snyk vs GitHub Code Security vs Semgrep: which enterprise AppSec platform should you choose in 2026?
An enterprise asks for “one security scanner”, but the real requirement normally contains several independent problems:
Read article