Can I scan any website?

Only scan sites you own or have permission to test. Unauthorized scanning may violate terms or laws.

What is Content-Security-Policy?

CSP tells the browser which content sources are allowed, preventing XSS by blocking inline scripts.

Why does my site score low?

Most sites lack security headers entirely. Adding HSTS, CSP, and X-Frame-Options raises scores significantly.

Do headers protect against all attacks?

No. They protect against specific client-side attacks. Server-side issues need different mitigations.

Header Auditor

Enter a website URL (including https://) you want to audit. Click "Check Headers" to fetch and analyze the site's HTTP security headers. Review the A-F letter grade for each security header with detailed feedback. Check the overall security score and fix recommendations for failing headers. Fetches HTTP response headers through the site API gateway, then grades each security header against OWASP and Mozilla Observatory standards. Only check sites you own or have permission to test.