All Tools
HTTP Security Headers Check
Analyze the security headers of any website to check for misconfigurations and vulnerabilities.
About security headers
HTTP security headers tell the browser to switch on defences against XSS, clickjacking, and content injection. We fetch the URL from our own server (browsers cannot read another site's response headers), follow redirects, and grade what the final response actually sends.
The rubric is weighted, not a checklist: Content-Security-Policy and HSTS do most of the work, so they carry most of the points. Every finding below shows its weight and the reasoning behind it.