scan.now
Premium Scan a site

Check a Website's HTTP Security Headers

Fetches the page and grades Content-Security-Policy, Strict-Transport-Security, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, the cross-origin isolation headers, cookie flags and CORS.

Public hosts only. About a handful of requests, usually finished in under 15 seconds. How we scan · Acceptable use

How it works

  1. Enter the URL

    We fetch it with a browser-like request and follow redirects.

  2. Headers are parsed, not just spotted

    A CSP with 'unsafe-inline' or an HSTS max-age of a day is flagged as weak, not passed.

  3. Copy the fix

    Each finding includes ready-to-paste values for nginx, Apache and common frameworks.

What this tool checks

29 checks across 3 areas. Each links to its reference page with the test, the risk and the fix.

Full reference

Cookie security

4 checks

HTTP security headers

13 checks

Transport security (HTTPS / TLS)

12 checks

The ones that most often decide the grade:

Critical HTTPS is availableThe site could not be reached over HTTPS on port 443, or the TLS handshake failed. Everything it serves travels in...
High HTTP redirects to HTTPSPort 80 serves page content instead of redirecting to HTTPS, or the redirect chain is wrong. Visitors who type the...
High Deprecated TLS versions accepted (1.0 / 1.1)The server still completes handshakes with TLS 1.0 or TLS 1.1. Both were formally deprecated by RFC 8996 in 2021 and...
Critical Certificate chain and hostname validationThe certificate presented for this hostname did not validate: The chain does not reach a trusted root, an...
High Certificate expiryThe certificate has expired or will expire within 30 days. Once it lapses every browser, API client and mail gateway...
High CORS allows arbitrary origins with credentialsThe server reflects any Origin in Access-Control-Allow-Origin while also sending Access-Control-Allow-Credentials:...

How HTTP security headers protect a page

Headers give the browser enforceable rules about scripts, framing, transport, content types and powerful device features.

Security headers are response instructions, not decorative metadata. A Content-Security-Policy can restrict script execution, HSTS can prevent an HTTPS connection from being downgraded, and frame controls can prevent another site from placing the page inside a deceptive overlay. Other policies reduce data leakage and disable browser capabilities the site never needs.

The scanner parses the values instead of awarding credit for presence alone. A CSP containing broad wildcards or unsafe script allowances is graded differently from a restrictive policy, and an HSTS header with a very short lifetime is not treated as equivalent to a durable deployment.

Fetch the pageFollow redirects and record the final response headers.
Parse each policyInspect directives, durations, origins, cookie flags and CORS behaviour.
Map gaps to fixesExplain the browser risk and provide implementation guidance.

Put this result in context

This scanner answers one part of the review. Continue with Website Scanner for headers, tls, cookies, exposed files, then LLM API Key Scanner for openai, anthropic, gemini and other ai keys. These are separate checks because a strong result here does not prove that the adjacent surface is healthy.

For the background behind these signals, read HTTP Security Headers Explained: Every Header, What It Blocks and How to Set It and Content Security Policy (CSP): A Practical Guide to Writing One That Works. The HTTPS is available check reference explains the exact test, evidence and remediation used in the report. The Scan.now methodology explains request limits, scan boundaries and what the scanner deliberately does not attempt.

Security header responsibilities

Each policy closes a different browser attack or privacy path.

Policy familyWhat the scanner reviewsPrimary protection
Content-Security-PolicyScript sources, unsafe allowances, object, base, frame and upgrade directives.Limits script injection and untrusted resource loading.
Strict-Transport-SecurityPresence, max-age, subdomain coverage and preload readiness.Keeps returning visitors on HTTPS.
Framing and MIMEframe-ancestors or X-Frame-Options, plus X-Content-Type-Options.Reduces clickjacking and content-type confusion.
Privacy policiesReferrer-Policy and Permissions-Policy directives.Restricts URL leakage and access to camera, microphone, location and other features.
Isolation, cookies and CORSCOOP, COEP, CORP, cookie flags and cross-origin response behaviour.Separates browsing contexts and protects session or cross-origin data.

How to interpret the header grade

A header can be present, weak or well configured. The value determines the protection.

Policy is effective

The header is present with a value that provides meaningful protection for the tested page.

Missing or unsafe

A missing policy or permissive directive leaves a practical browser attack path open and should be reviewed.

Context-dependent

Some isolation or permissions policies depend on application features. Confirm compatibility before enforcing them site-wide.

Deploy headers safely

  • Set shared headers at the reverse proxy, CDN or framework middleware so error pages and redirects receive them too.
  • Roll out CSP in report-only mode, remove unexpected dependencies, then enforce the tested policy.
  • Apply Secure, HttpOnly and an appropriate SameSite value to every sensitive cookie.
  • Check representative routes because applications and CDNs often vary policies by path.

What this result does not prove

  • The scan sees the response for the entered page; another route, status code or geographic edge may send different headers.
  • A strong header policy reduces impact but does not repair vulnerable application code.
  • The scanner does not execute the entire application to prove that a stricter policy will preserve every feature.

Related tools

Continue the review with four checks that cover adjacent parts of the same attack surface.

All tools
Websites Website Vulnerability Scanner

Headers, TLS, cookies, exposed files
Websites LLM API Key Exposure Scanner

OpenAI, Anthropic, Gemini and other AI keys
Websites SSL / TLS Checker

Certificate, expiry, protocols, ciphers
Websites Email Security Checker (SPF, DKIM, DMARC)

SPF, DKIM, DMARC and MX records

Wondering how this stacks up against the tool you already use? We wrote up how this compares with securityheaders.com, including the things it does better than us.

Guides for this tool

Background reading written to go with these results.

9 min read · Updated Sep 15, 2026 HTTP Security Headers Explained: Every Header, What It Blocks and How to Set It

Security headers are instructions a server sends the browser to switch on protections: Framing, MIME sniffing, referrer leakage, script...

Read the guide
9 min read · Updated Sep 16, 2026 Content Security Policy (CSP): A Practical Guide to Writing One That Works

A Content Security Policy tells the browser which scripts, styles and resources a page may load, which defeats most cross-site...

Read the guide
8 min read · Updated Sep 17, 2026 HSTS Explained: Strict-Transport-Security, Preloading and the Downgrade Attacks It Stops

HTTP Strict Transport Security tells the browser to never load a site over plain HTTP again. The header, max-age and includeSubDomains,...

Read the guide
8 min read · Updated Sep 14, 2026 Clickjacking Explained: How Invisible Frames Hijack Clicks and How to Prevent It

Clickjacking loads your site invisibly inside an attacker's page and tricks users into clicking buttons they cannot see. The attack,...

Read the guide
8 min read · Updated Sep 05, 2026 Cookie Security Flags: Secure, HttpOnly, SameSite and Cookie Prefixes

A session cookie without the right flags can be stolen over HTTP, read by injected script or sent in a forged cross-site request. Each...

Read the guide

Frequently asked questions

Which header matters most?

Content-Security-Policy, because it defeats most cross-site scripting, followed by Strict-Transport-Security. The rest are quick wins.

Why did my CSP get flagged even though it exists?

A policy that allows 'unsafe-inline' in script-src, wildcards, or omits object-src and base-uri leaves the main attack paths open. The report says which directive.

Do I need Permissions-Policy on a plain content site?

It costs nothing and disables camera, microphone and geolocation for any script that ends up on your page, including injected ones.

Is X-XSS-Protection still useful?

No. Browsers removed the auditor it controlled; set it to 0 or omit it and use a CSP.