Scan a website's HTTP response headers and grade its security posture with actionable improvement suggestions.
A single request can carry a dozen headers that silently shape how safe a site is, and this tool walks each one: what the server sends, whether the values are strong, and what is missing. The result is a per-header verdict list with an overall grade and copy-paste fixes. The surprise most people hit first: the scan runs entirely in the browser, and browser rules hide most of another site's headers from it, so you will frequently paste headers you captured yourself rather than scan a bare URL.
A concrete input and expected output from the current implementation.
Input
HTTP/2 200 server: nginx strict-transport-security: max-age=63072000; includeSubDomains content-security-policy: default-src 'self' x-content-type-options: nosniff x-frame-options: DENY referrer-policy: strict-origin-when-cross-origin permissions-policy: camera=(), microphone=(), geolocation=()
Expected output
strict-transport-security pass two-year max-age, includeSubDomains set content-security-policy warn present, but default-src 'self' alone is a thin policy x-content-type-options pass nosniff x-frame-options pass DENY (CSP frame-ancestors is the newer alternative) referrer-policy pass strict-origin-when-cross-origin permissions-policy pass camera, microphone, geolocation blocked cross-origin-opener-policy fail missing - add: cross-origin-opener-policy: same-origin server warn banner reveals nginx Overall grade: B - six of seven core headers present; two warnings and one missing header keep it from an A.
Each verdict follows directly from the pasted text: all six present headers carry recognized values, while cross-origin-opener-policy is absent entirely and the CSP's default-src 'self' is minimal. Six of seven core headers present with two warnings gives the B shown - the missing header and the warnings keep it short of an A.
The scan compares the submitted headers against a current checklist of protections: Strict-Transport-Security, Content-Security-Policy, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy, and the cross-origin isolation pair. For each it judges presence and value quality, so an HSTS header without includeSubDomains or with a short max-age is scored as weaker than its mere presence suggests.
Every header earns pass, warn, or fail: missing protections fail, weak values warn, and deprecated headers such as X-XSS-Protection or banners that reveal the server software are called out. The overall letter grade summarizes the set, and the report ends with concrete example header values you can copy into a server, CDN, or framework configuration.
Browser security rules limit what scripts on one site can read from another: a cross-origin fetch exposes only a small safelisted set of headers, such as Cache-Control and Content-Type. Security headers like HSTS and CSP are visible only if the target opts in with Access-Control-Expose-Headers. Capturing headers with curl -sI or DevTools and pasting them gives the scanner the full picture.
Not by itself. The grade measures whether protections are configured; it is not proof of an exploitable weakness. A missing Content-Security-Policy matters most when the site also has a way for attacker-controlled content to reach the page, such as a stored or reflected XSS bug. Fix the headers, then treat the result as one layer of a broader security review.
The example and behavioral notes were checked against the browser implementation. Standards and primary references below define the relevant format, formula, or platform behavior.
Generate strong, random passwords with customizable length, character sets, and complexity requirements.
Analyze password strength with entropy scoring, crack-time estimates, and improvement suggestions.
Create cryptographically random strings for API keys, tokens, salts, and unique identifiers.
Create QR codes for URLs, text, Wi-Fi credentials, vCards, and more with customizable size and colors.
Scan and decode QR codes from uploaded images or your device camera to extract embedded data.
Compute MD5, SHA-1, SHA-256, and SHA-512 checksums to verify file integrity and detect tampering.