Scan Your Site Now

Security headers play a crucial role in protecting web users and preventing browser-based attacks. When properly configured, they can help stop:

• Cross-Site Scripting (XSS)
• Clickjacking
• MIME-type sniffing
• Insecure third-party embedding
• Cross-Origin data leaks

These headers tell browsers how to handle your site’s content securely. Without them, attackers may exploit default browser behavior, even on well-developed applications.

The following headers are widely considered essential for strong browser-side security:

• Content-Security-Policy (CSP): Prevents unauthorized scripts from running
• Strict-Transport-Security (HSTS): Forces use of HTTPS
• X-Frame-Options: Prevents clickjacking attacks via iframes
• X-Content-Type-Options: Stops MIME-type sniffing
• Referrer-Policy: Limits how much referrer information is shared
• Permissions-Policy: Controls access to sensitive browser features
• Cross-Origin headers (COOP, CORP, COEP): Enforce isolation and prevent data leakage

Enabling these headers properly can significantly reduce your attack surface.

The scanner breaks down your results into individual headers, showing whether each one is missing, weak, or secure.

When a misconfiguration is detected, you’ll see a dedicated 'Recommendations' section. It not only suggests best-practice values, but also explains what’s wrong — such as unsafe directives, deprecated options, or missing flags. Here's how to act on the results:

1. Review each header’s status and read the recommendation
2. Update your server or application configuration accordingly
3. Rerun the scan to verify the fix

This helps you implement changes with clarity and validate them in real-time.

Our scanner assigns a security score from 0 to 100 based on how well your site is using HTTP security headers.

• A score of 100 means all key headers are implemented and securely configured
• A score of 0 means none are present or all are insecure
• Partial scores reflect a mix of good and poor practices

The score is weighted: some headers like Content-Security-Policy and HSTS have a greater impact than others. If a header exists but is configured weakly (e.g. allows unsafe-inline), it still results in a score reduction. This makes the score a meaningful and actionable representation of your browser-layer security posture.

The color-coded output makes it easy to visually assess the state of each security header at a glance. Each color represents a specific evaluation result:

• Red: The header is completely missing and provides no protection.
• Yellow: The header exists but is misconfigured or only partially effective.
• Dark Blue: The header is present and securely configured according to modern best practices.

These visual indicators help you quickly understand which areas require attention, which are potentially risky, and which are already secured. It's an efficient way to prioritize fixes during security reviews or CI/CD pipeline checks.

Yes. If you encounter any bugs, have feature requests, or just want to share feedback, feel free to reach out to us directly at: [email protected]