Transport and content controls
Check HSTS for HTTPS enforcement and Content-Security-Policy for restrictions on scripts, frames, images, connections, and other resources.
Check HTTP security headers in seconds.
A focused scanner for HSTS, CSP, clickjacking, MIME sniffing, cookie attributes, cross-origin isolation, and avoidable information leakage.
Focused browser defenses
What the security header scanner checks
HeaderSec reads the response headers returned by a public website, grades the protections it can verify, and explains what to change. It does not modify the site or attempt to exploit it.
Clickjacking and MIME defenses
Find missing frame protections and X-Content-Type-Options, two focused controls that reduce
unsafe embedding and content-type confusion.
Privacy and browser capabilities
Review Referrer-Policy, Permissions-Policy, cookie attributes, and cross-origin policies that limit what a page discloses or allows.
From response to remediation
How HeaderSec works
- Enter a public URL. HeaderSec normalizes the address and safely fetches its response.
- Review evidence. See which headers were present, missing, or configured weakly.
- Apply the guidance. Use the remediation notes, then rescan to validate the deployed change.
New to these controls? Read the HTTP security headers guide for practical baselines, examples, and deployment cautions.
Common questions
Security header scanner FAQ
Does a high score mean a website is secure?
No. Security headers reduce specific browser-side risks, but they do not test application code, access control, dependencies, infrastructure, or every vulnerability class. Treat the result as one part of a broader security review.
Can HeaderSec scan a local or private website?
No. The scanner accepts public HTTP and HTTPS targets. Private, loopback, and internal network addresses are blocked to protect the service and its users.
Should every site use the same Content-Security-Policy?
No. A CSP must match the resources and integrations a site genuinely needs. Start in report-only mode where appropriate, observe violations, and tighten the policy without breaking required functionality.