Security Headers Scanner
Scan a URL's HTTP security headers (HSTS, CSP, X-Frame-Options and more) and grade the posture A–F. Free, live server-side fetch.
Scan security headers
Enter a URL. We fetch it and grade its HTTP security-header posture.
What this security headers scanner does
Common use cases
- 1Hardening a site's HTTP security
- 2Passing a security review or audit
- 3Confirming HSTS and CSP are deployed
- 4Benchmarking header posture over time
- 5Prioritising which headers to add first
- 6Checking a staging vs production config
Related tools
About security headers
HTTP security headers instruct the browser to enforce protections that defend your visitors: HSTS forces HTTPS, CSP blocks injected scripts, X-Content-Type-Options stops MIME sniffing, and X-Frame-Options prevents clickjacking. Together they close off whole classes of attack.
This scanner fetches the page and grades which of the key headers are present, weighted by impact. It is a presence check — a header must also have a sound value to be effective, so treat a good grade as the starting point and review each policy (especially your CSP) in detail.
More Free Tools Where This Came From
This utility is one of dozens of free, no-login tools for DNS, email, SEO and developers — all instant and private.
HostCloud.in · Pune, India · Serving 34,987+ Websites Since 2020
Got Questions? We Have Answers.
Which headers does it check?
The six key security headers: Strict-Transport-Security, Content-Security-Policy, X-Content-Type-Options, X-Frame-Options, Referrer-Policy and Permissions-Policy, weighted by impact into an A–F grade.
Does a good grade mean I am secure?
It is a strong start, but the grade is presence-based. A header must also have a sound value — a weak CSP still counts as present — so review each policy in detail.
Which header should I add first?
HSTS and a Content-Security-Policy carry the most weight, closing off downgrade attacks and XSS respectively.
Is it live?
Yes. The headers are fetched server-side in real time.