scan.now
Premium Scan a site

Check a Website's HTTP Security Headers

Fetches the page and grades Content-Security-Policy, Strict-Transport-Security, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, the cross-origin isolation headers, cookie flags and CORS.

Public hosts only. About a handful of requests, usually finished in under 15 seconds. How we scan · Acceptable use

Illustration of the security headers checker in use

How it works

  1. Enter the URL

    We fetch it with a browser-like request and follow redirects.

  2. Headers are parsed, not just spotted

    A CSP with 'unsafe-inline' or an HSTS max-age of a day is flagged as weak, not passed.

  3. Copy the fix

    Each finding includes ready-to-paste values for nginx, Apache and common frameworks.

What this tool checks

29 checks across 3 areas. Each links to its reference page with the test, the risk and the fix.

Full reference

Cookie security

4 checks

HTTP security headers

13 checks

Transport security (HTTPS / TLS)

12 checks

The ones that most often decide the grade:

Critical HTTPS is availableThe site could not be reached over HTTPS on port 443, or the TLS handshake failed. Everything it serves travels in... High HTTP redirects to HTTPSPort 80 serves page content instead of redirecting to HTTPS, or the redirect chain is wrong. Visitors who type the... High Deprecated TLS versions accepted (1.0 / 1.1)The server still completes handshakes with TLS 1.0 or TLS 1.1. Both were formally deprecated by RFC 8996 in 2021 and... Critical Certificate chain and hostname validationThe certificate presented for this hostname did not validate: The chain does not reach a trusted root, an... High Certificate expiryThe certificate has expired or will expire within 30 days. Once it lapses every browser, API client and mail gateway... High CORS allows arbitrary origins with credentialsThe server reflects any Origin in Access-Control-Allow-Origin while also sending Access-Control-Allow-Credentials:...

Wondering how this stacks up against the tool you already use? We wrote up how this compares with securityheaders.com, including the things it does better than us.

After this one, most people run Website Scanner, SSL / TLS Checker, or Email (SPF, DKIM, DMARC). Each answers a different question about the same thing, and the full list of tools explains which to reach for when. Every finding links through to the checks reference.

Guides for this tool

Background reading written to go with these results.

9 min read · Updated Sep 15, 2026 HTTP Security Headers Explained: Every Header, What It Blocks and How to Set It

Security headers are instructions a server sends the browser to switch on protections: Framing, MIME sniffing, referrer leakage, script...

Read the guide 9 min read · Updated Sep 16, 2026 Content Security Policy (CSP): A Practical Guide to Writing One That Works

A Content Security Policy tells the browser which scripts, styles and resources a page may load, which defeats most cross-site...

Read the guide 8 min read · Updated Sep 17, 2026 HSTS Explained: Strict-Transport-Security, Preloading and the Downgrade Attacks It Stops

HTTP Strict Transport Security tells the browser to never load a site over plain HTTP again. The header, max-age and includeSubDomains,...

Read the guide 8 min read · Updated Sep 14, 2026 Clickjacking Explained: How Invisible Frames Hijack Clicks and How to Prevent It

Clickjacking loads your site invisibly inside an attacker's page and tricks users into clicking buttons they cannot see. The attack,...

Read the guide 8 min read · Updated Sep 05, 2026 Cookie Security Flags: Secure, HttpOnly, SameSite and Cookie Prefixes

A session cookie without the right flags can be stolen over HTTP, read by injected script or sent in a forged cross-site request. Each...

Read the guide

Frequently asked questions

Which header matters most?

Content-Security-Policy, because it defeats most cross-site scripting, followed by Strict-Transport-Security. The rest are quick wins.

Why did my CSP get flagged even though it exists?

A policy that allows 'unsafe-inline' in script-src, wildcards, or omits object-src and base-uri leaves the main attack paths open. The report says which directive.

Do I need Permissions-Policy on a plain content site?

It costs nothing and disables camera, microphone and geolocation for any script that ends up on your page, including injected ones.

Is X-XSS-Protection still useful?

No. Browsers removed the auditor it controlled; set it to 0 or omit it and use a CSP.