Security Header Scan
Grades a site’s HSTS, CSP, frame, referrer and permissions headers and shows what to add.
Most of the headers that harden a site cost one line of configuration each and are absent from most sites because nobody has looked. This fetches a URL and grades what came back — HSTS, CSP, framing, referrer and permissions policy — with the line to add for each one that is missing.
Our server makes this request for you. Only the URL you typed is sent to it — none of your cookies or login state goes along. The server will only connect to public addresses and refuses private and internal ones.
How to use it
Enter the URL
Use the address people actually visit. Headers frequently differ between the apex and `www`, and between the HTML document and static assets served by a different layer.
Fix the framing and transport ones first
`Strict-Transport-Security` and a `frame-ancestors` directive are cheap, have no rendering effect and close two whole classes of attack. Start there.
Take CSP separately
A content security policy needs to be built against what your pages load, not pasted from a report. The CSP builder does that part.
Common questions
Is a good grade a secure site?
No. It means a set of response headers is present. It says nothing about authentication, injection flaws, access control or what is running behind the URL — the entire substance of a site’s security is out of view here.
My headers are set but not detected.
Check the response actually being graded — a redirect from `http` to `https`, or from apex to `www`, may be what was fetched. A CDN or WAF in front can also strip or add headers after your origin sets them.
Should I enable HSTS preload?
Only when every subdomain, present and future, can serve HTTPS — preload is baked into browsers and removal takes months. Run `max-age` at a short value first and raise it once you are sure.
Feed it from
HTTP Header Inspector
Fetches a URL and shows the full response headers, redirect chain, timings and compression used.
SSL Certificate Checker
Connects to a host, shows the served chain, expiry, protocol and cipher support, and flags chain gaps.
Subresource Integrity Hash
Computes the Subresource Integrity attribute (sha256/384/512) for a script or stylesheet you paste or drop in.
CSP Builder
Builds a Content-Security-Policy from a guided form or from a report, and explains each directive.
Next
These accept what this tool produces, so the result can go straight in.
CORS Tester
Sends the preflight a browser would send from a chosen origin plus a GET with that Origin, and explains by the Fetch standard’s rules exactly which header blocked it.
CSP Builder
Builds a Content-Security-Policy from a guided form or from a report, and explains each directive.
HTTP Header Inspector
Fetches a URL and shows the full response headers, redirect chain, timings and compression used.
SSL Certificate Checker
Connects to a host, shows the served chain, expiry, protocol and cipher support, and flags chain gaps.
CSV Cleaner
Trims cells, normalises headers, fixes number and date formats and reports rows with the wrong column count.
CSV Join
Joins two tables on a key column with inner, left, right or outer semantics and shows unmatched rows.