Website Security Headers Scanner
Get a security grade for any website — HTTPS, HSTS, Content-Security-Policy, clickjacking protection, cookie flags, mixed content and version disclosure — with fixes for each issue.
How to use
- 1Enter a website.
- 2See your grade and each check, most important first.
- 3Add the missing headers in your server or CDN settings.
Frequently asked questions
Is this scan safe to run on any site?
Yes — it's passive. It loads one page like a browser and reads the response; it never sends attack payloads.
What matters most?
HTTPS with an HTTP→HTTPS redirect, HSTS and a Content-Security-Policy give the biggest protection.
Does an A+ mean my site is secure?
No — it means the browser-side protections are set up well. Application bugs need code review and penetration testing.