Skip to main content

Free security tool

Security Headers Scanner

Enter a URL to grade its HTTP security headers and cookie flags, with concrete fixes for every gap.

Passive check of publicly-served response headers. Only scan sites you own or are authorized to test.

HTTP security headers guide

Find web security header gaps before attackers do

HTTP response headers give browsers instructions that reduce common attack paths. This security headers scanner checks a public URL and turns the response into a practical hardening checklist for application and platform teams.

Headers that matter most

A strong baseline usually includes a carefully designed Content-Security-Policy, HSTS, clickjacking protection, MIME sniffing protection, a deliberate Referrer-Policy, and a restrictive Permissions-Policy. Cookie attributes also matter because they control how browser credentials are sent.

  • Content-Security-Policy
  • Strict-Transport-Security
  • X-Frame-Options or frame-ancestors
  • Secure, HttpOnly, and SameSite cookies

How to prioritize findings

Start with headers that reduce direct exploitability, then validate compatibility with every application flow and third-party integration. Use report-only policies and staged rollouts when a change could block legitimate scripts, frames, or API requests.

Passive URL scanning

The scanner reads the public HTTP response and does not attempt to exploit the target. Run it against a staging environment during development, then repeat it after deployment so reverse proxies, CDNs, and platform defaults are included in the check.