Security Headers Scanner
The Security Headers Scanner fetches a URL and checks it for six headers that browsers use to enforce security policy: Strict-Transport-Security, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy and Permissions-Policy. It returns a simple grade out of 6 along with the exact value of each header that is present, so you can see precisely what your server is sending. Use it to audit your own site before launch or to see how a competitor or vendor has configured theirs.
How it works
Reading another site's response headers from client-side JavaScript is blocked by the same-origin policy unless that site opts in with CORS, which security-conscious sites configuring these very headers often do not do for arbitrary callers. So the scan is performed by our edge proxy, which requests the URL on your behalf and returns the full set of response headers it received.
The proxy checks for six specific headers that browsers use to reduce common attack surface: Strict-Transport-Security (forces HTTPS on future visits), Content-Security-Policy (restricts what scripts, styles and resources a page may load), X-Frame-Options (blocks a page from being embedded in a clickjacking iframe), X-Content-Type-Options (stops browsers from guessing a file's MIME type), Referrer-Policy (controls how much of the URL leaks to other sites via the Referer header) and Permissions-Policy (restricts access to browser features like camera or geolocation). Each header that's present is shown with its actual value; each one that's missing is flagged, and the count of headers present out of six becomes the grade.
Only the URL you scan is sent to the proxy for that single request — it is not stored, logged, or reused for anything else.
Frequently asked questions
What's a good security headers grade?
A score of 5 or 6 out of 6 is a strong baseline for a production site. Which specific headers matter most depends on your threat model — a static marketing site has different needs than an app handling user sessions.
Why is Content-Security-Policy often missing even on well-built sites?
CSP is powerful but easy to misconfigure and break your own scripts with, so many teams delay adopting it or roll it out gradually with a report-only mode first. A missing CSP is common but still worth fixing.
Does a perfect score mean my site is secure?
No. These six headers reduce specific classes of browser-level attacks like clickjacking and MIME sniffing, but they say nothing about your server code, dependencies, authentication, or infrastructure security.
What does X-Frame-Options actually protect against?
It stops other sites from embedding your page inside an invisible iframe to trick users into clicking something they didn't intend to — a technique called clickjacking.
Should I use Permissions-Policy if my site doesn't use camera or microphone?
Yes — explicitly denying features you don't use is a cheap way to reduce the impact of an XSS bug that tries to abuse them, even on a simple site.