Free Security Headers Analyzer

Security Headers Analyzer

Check HTTP security headers for any domain.

HTTP security headers are instructions a web server sends with every response to tell browsers how to behave. They form a critical defense layer against common attacks without requiring changes to your application code.

Key headers and what they prevent:

Content-Security-Policy (CSP) — Prevents cross-site scripting (XSS) by restricting which scripts, styles, and resources the browser may load.
Strict-Transport-Security (HSTS) — Forces browsers to use HTTPS only, preventing man-in-the-middle (MITM) and protocol downgrade attacks.
X-Frame-Options — Prevents clickjacking by controlling whether your site can be embedded in iframes.
X-Content-Type-Options — Prevents MIME-type sniffing, stopping browsers from executing files as a different type than declared.
X-XSS-Protection — Legacy browser filter for reflected XSS (deprecated in modern browsers but still useful).
Referrer-Policy — Controls how much referrer data is sent to other sites, protecting privacy and sensitive URLs.
Permissions-Policy — Restricts which browser features (camera, microphone, geolocation) the page can use.

This tool sends a request to the target domain and evaluates each header, scoring your configuration from A (best) to F (critical gaps).

cloudflare.comgithub.comgoogle.com

Want the full picture?

Run a free Website Health Check →

Common questions

What security headers should my site have?

Key security headers include Content-Security-Policy, Strict-Transport-Security, X-Content-Type-Options, X-Frame-Options, and Referrer-Policy.

How is the security header score calculated?

The score is based on which recommended headers are present and properly configured. Each missing or misconfigured header reduces your grade.

Does this tool store my URL or headers?

No. The scan runs in real-time and no results are saved to any server or database.

What the Security Headers analyzer checks

HTTP security headers tell browsers how to handle your site: whether to force HTTPS, block clickjacking, restrict script sources, and prevent MIME sniffing. This tool fetches response headers from a live URL and grades your configuration against common best practices — including HSTS, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy.

When to analyze security headers

After launching a new site or web application
Following a penetration test or security audit remediation
When migrating behind a CDN or reverse proxy (headers may change)
Before compliance reviews (PCI, SOC2 questionnaires often ask about HSTS/CSP)
Comparing staging vs production configuration

How to read the grade

The letter grade summarizes header presence and quality. A means critical headers are present with sensible values. Lower grades indicate missing or weak headers that leave users exposed to XSS, clickjacking, or protocol downgrade attacks. Each header in the breakdown explains what it does and what value was detected (or that it was absent).

HSTS with max-age of at least one year and includeSubDomains is ideal for public sites. CSP is the strongest XSS defense but requires careful tuning — start with report-only mode in production if unsure.

Common mistakes

HSTS missing on HTTPS sites — users can be downgraded to HTTP on first visit
X-Frame-Options: ALLOWALL or missing — enables clickjacking
CSP with unsafe-inline and unsafe-eval — weakens XSS protection
Headers set only on HTML pages but not API responses
CDN stripping or overriding origin security headers

Example scenario

A SaaS dashboard was embeddable in iframes on any domain because X-Frame-Options and CSP frame-ancestors were absent. Adding Content-Security-Policy: frame-ancestors 'self' blocked unauthorized embeds without breaking their own help documentation site.

Limitations

We analyze headers returned for a single URL request. Different paths may return different headers. We do not test whether CSP policies actually block real attacks — only whether headers are present. See Common Security Header Mistakes for remediation patterns.

Related resources

CSP Header Guide · Header Inspector · HTTP Headers Guide · Website Health Check