Security headers,
graded instantly.
Paste any URL. Get a letter grade and plain-language guidance on every missing or misconfigured HTTP security header - in under 5 seconds.
Read our full security headers checklist or check the frequently asked questions.
10
Total scans
60%
Top grades (A+/A)
10%
Medium grades (B/C)
30%
Failing (D/E/F)
Everything you need to ship secure headers
Instant grading
Get an A+ to F grade with a numeric score in under 5 seconds. No waiting.
Plain-language explanations
Every missing header gets a plain English explanation of what it does and why it matters.
Permanent permalinks
Every scan gets a shareable /report/[domain] URL you can link from tickets or Slack.
Raw header inspector
See every response header your server sends, not just the security-relevant ones.
Download report
Export your results as JSON for dev tools or build pipelines.
Embeddable badge
Scanned by SecHead badge with a one-line embed code for your README or site.
What are HTTP Security Headers?
When a browser requests a page from your web server, the server responds with the content along with HTTP response headers containing metadata about the response - including security policies.
Security headers instruct the browser on how to behave when handling your site's content. They enforce secure connections (HTTPS), prevent malicious scripts from executing (XSS), and stop other sites from embedding your pages (Clickjacking).
Why do they matter for your site?
Without properly configured security headers, your website and your users are vulnerable to common web attacks. Implementing these headers is one of the easiest and most effective ways to harden your web application.
- Protect your users: Prevent cross-site scripting (XSS) and data injection attacks.
- Improve SEO: Search engines like Google favor secure websites.
- Compliance: Many security audits and compliance frameworks require strict security headers.
Essential Headers to Check
Our scanner analyzes your site for the most critical modern security headers, including:
- Content-Security-Policy (CSP): The ultimate defense against XSS.
- Strict-Transport-Security (HSTS): Forces browsers to strictly use HTTPS.
- X-Frame-Options: Prevents clickjacking by controlling framing.
- X-Content-Type-Options: Stops MIME-sniffing vulnerabilities.
- Referrer-Policy: Controls how much referrer information is passed along.
Recent Scans
Ready to check your headers?
Free, instant, no account required. Uncover missing security headers in seconds.