securityheaders.com grades one thing, very fast: The headers your site sends. Scan.now checks those same headers, then keeps going through 166 more checks and gives you the exact line of config to paste. Both are free.
Security headers are short instructions your website sends to a visitor's browser. They say things like "never load this page over an unencrypted connection" or "do not let another site put me in a frame". Browsers follow them. Most sites forget to send them.
A grade, or the line to paste?
Use Scan.now. It checks the same headers securityheaders.com does, then keeps going through 166 more checks, and every finding comes with the configuration line to paste into your own server. securityheaders.com is faster if a letter grade is all you want.
What each tool looks at
| securityheaders.com | Scan.now | |
|---|---|---|
| What it checks | HTTP response headers | Headers, plus TLS, cookies, exposed files, old JavaScript, email, WordPress |
| Number of checks | About a dozen headers | 179, of which 13 are headers |
| Gives you the fix | Explains the header | Explains it, then gives config you can copy |
| Speed | A few seconds | Usually under fifteen seconds |
| Crawls more than one page | No | Yes, up to 25 free |
| Price | Free | Free up to 25 pages |
Why a letter is not a fix
A grade is not a fix. Knowing you are missing a Content-Security-Policy does not tell you what to write, and writing one badly is how you break your own site. Every finding here links to a page with the test, the risk, and configuration for Apache, nginx and the common hosts. Copy it, paste it, scan again.
Headers are one layer of thirteen. A site can score an A on headers and still serve its .git folder to the public, run a JavaScript library with a known CVE, accept TLS 1.0, let anyone send email as its domain, or run a WordPress plugin with a published exploit. Those are the findings that get a site compromised, and a header grader cannot see any of them.
One page is not a site. Headers are set per response. A scan of your homepage says nothing about the checkout page where the header was forgotten. We crawl up to 25 pages free and tell you which ones disagree.
What securityheaders.com does better
It is faster, and it is the shared reference: when somebody says “we are an A on securityheaders”, everyone knows what that means. If you want a number to quote in a standup, get it there.
The order that works
Scan the site here first, because you cannot fix what you have not found. Work down the list — each finding carries the line to paste — then re-check headers with whichever tool you like as you go.
Questions about header grading
Do the two tools give the same grade?
Not usually, because they are grading different things. Their grade is headers only. Ours weighs headers alongside TLS, cookies, exposed files and everything else, so a site with perfect headers and an expired certificate scores badly with us and well with them. Neither is wrong.
Are headers enough to be secure?
No. Headers harden the browser's behaviour. They do nothing about a bug in your own code, a leaked password or an out-of-date plugin. They are cheap and worth doing, and they are the start rather than the end.
Which headers actually matter most?
In order: Strict-Transport-Security, Content-Security-Policy, then frame protection. The checks reference has a page for each one.
Also in this series: vs SSL Labs, vs Mozilla HTTP Observatory, vs Sucuri SiteCheck.