Security Headers Scanner

Response headers like Strict-Transport-Security, Content-Security-Policy and X-Frame-Options that tell browsers to enforce protections against clickjacking, downgrade attacks and cross-site scripting. Missing headers are one of the most common — and cheapest to fix — web weaknesses.

This tool only sends a single ordinary page request — the same as visiting the site in a browser — and reads the response headers. Still, you should only scan sites you own or operate.