Loading
Loading
We use strictly necessary cookies to run this site, and analytics cookies to understand how it's used. See our Privacy Policy for details.
Free tool
Enter a domain to fetch its HTTP response headers and grade them against 8 browser-level defenses, Content-Security-Policy, HSTS, clickjacking protection, and more. These headers cost nothing to add and close off entire classes of attack, but most sites still ship without them.
Fetches the site's homepage directly and grades its HTTP response headers against 8 browser-level defenses (CSP, HSTS, clickjacking protection, and others), the same checks every well-known headers scanner runs.
By using this tool, you agree to our Terms of Service , only run it against something you own or are authorized to assess.
Adding these headers is usually a small, low-risk change, we help figure out the right policy for your specific stack and roll it out without breaking anything.