Security Headers Scanner
Analyse CSP, HSTS, X-Frame-Options and more, with traffic-lights and an overall security grade.
About this tool
The Security Headers Scanner analyzes a site's HTTP response headers (CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy) and gives you an overall score. It is the fast way to know how exposed a site is to XSS, clickjacking and other browser attacks.
- See which headers are missing and why they matter, with a status light for each.
- Check whether you have a real Content-Security-Policy or only report-only.
- Verify HSTS and its max-age before truly forcing HTTPS.
Frequently asked questions
Which security headers are essential?
At minimum: Content-Security-Policy (mitigates XSS), Strict-Transport-Security (forces HTTPS), X-Content-Type-Options: nosniff, and X-Frame-Options or frame-ancestors (against clickjacking). Referrer-Policy and Permissions-Policy add extra points.
Does a good score mean my site is secure?
It means the browser layer is well hardened, but it does not cover application, authentication or infrastructure vulnerabilities. It is a complementary check, not a full audit.
Why is Content-Security-Policy the hardest one?
Because you must list every origin of scripts, styles and images your site uses. The usual path is to start in report-only mode, review what it would block, then switch to enforce.