Free Security Headers Checker

Introduction to Security Header Analysis

Deploying HTTP security headers is only half the battle; teams must continuously verify that load balancers, CDNs, and deployment pipelines actually deliver those directives on every response. A remote security headers checker fetches live pages exactly as browsers do, exposing gaps between intended policy and production reality.

ScanSuite's free security headers checker analyzes public URLs for Strict-Transport-Security, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, and legacy X-XSS-Protection. Each header receives a pass, warning, or fail status with severity weighting that rolls up into a percentage score and letter grade from A+ through F.

Use scan results to prioritize remediation—missing CSP is flagged critical, absent HSTS is high severity, and weak Referrer-Policy values trigger low-severity warnings. Export JSON reports for compliance evidence and cross-reference fixes with the security headers generator for Nginx, Apache, Netlify, and Vercel deployment snippets.

What Is a Security Headers Checker?

A security headers checker (also called a security headers scanner or analyzer) sends an HTTP GET request to a user-supplied URL and parses response headers against security baselines. Unlike static configuration linters, remote checkers validate what external clients actually receive after TLS termination, redirects, caching layers, and edge rewrites.

ScanSuite evaluates HSTS for max-age duration and includeSubDomains presence, CSP for unsafe-inline and unsafe-eval directives, X-Frame-Options for DENY or SAMEORIGIN values, X-Content-Type-Options for nosniff, Referrer-Policy for privacy-preserving modes, and Permissions-Policy for feature restrictions. Deprecated X-XSS-Protection triggers informational guidance to migrate toward CSP.

The weighted scoring model assigns higher impact to critical missing controls like CSP and high-severity gaps like absent HSTS, producing grades that security teams can track over time during sprint remediation and pre-release regression testing.

Why Check Security Headers Remotely?

Local configuration files do not guarantee headers reach browsers. Misconfigured reverse proxies, Cloudflare page rules, Kubernetes ingress annotations, and Netlify path-scoped _headers files frequently drop or override origin directives without obvious build failures.

Remote scanning mirrors attacker and customer vantage points, catching issues invisible in repository diffs. ScanSuite surfaces exact header values returned by the live site, recommended replacement strings, and severity labels so developers can open tickets with concrete fix instructions instead of generic "improve security" tasks.

Regular header audits complement TLS validation with the SSL checker, cross-origin testing with the CORS checker, and policy authoring with the CSP generator and security headers generator—forming a complete pre-production security workflow.

Who Uses Security Headers Scanners?

Web developers run header checks after every deploy to staging and production, confirming CI/CD pipelines did not regress HSTS or X-Frame-Options during infrastructure migrations.

Security analysts and penetration testers include header analysis in reconnaissance phases, documenting missing CSP and clickjacking protections in assessment reports with reproducible scan timestamps.

Compliance and DevSecOps teams schedule periodic scans of customer-facing domains, exporting JSON results for SOC 2 evidence and comparing scores before and after remediation sprints.

How the Security Headers Checker Works

When you submit a URL, ScanSuite normalizes the input (adding https:// if omitted), performs a server-side HTTP request to fetch response headers, and passes the header map through a rules engine. Each rule checks presence, value format, and alignment with recommended secure baselines.

HSTS passes when max-age is at least 31536000 and includeSubDomains is set; partial configurations earn warnings. CSP fails when absent, warns on unsafe directives, and passes on restrictive policies. X-Frame-Options fails when missing and passes on DENY or SAMEORIGIN. Similar logic applies to MIME-sniffing, referrer, and permissions headers.

The scoring engine multiplies severity weights (critical 25, high 20, medium 15, low 10, info 5) by pass (100%), warn (50%), or fail (0%) status per check, producing a percentage rounded to an integer and mapped to letter grades: A+ at 90%+, A at 80%+, B at 70%+, C at 60%+, D at 50%+, F below 50%.

Interpreting a Failed CSP Result

A scan of `https://app.example.com` might show Content-Security-Policy as fail with critical severity, recommendation "Add a Content-Security-Policy header to prevent XSS attacks", and score contribution zero because CSP carries the highest weight.

The developer opens the CSP generator, builds a restrictive policy allowing only self-hosted scripts, deploys via Nginx, and rescans to observe CSP status change to pass with a score jump from D to B or higher.

If CSP passes but uses 'unsafe-inline', the checker issues a medium warning recommending nonce or hash-based alternatives—worth addressing before claiming A+ readiness.

HSTS Warning on Partial Configuration

A site returning `Strict-Transport-Security: max-age=86400` without includeSubDomains earns a warn status: present but not optimally configured, with recommendation to use max-age >= 31536000 and includeSubDomains.

Updating max-age to one year via the security headers generator and redeploying typically moves HSTS to pass on the next rescan, adding up to twenty weighted points toward the overall grade.

Before enabling preload, confirm all subdomains serve valid HTTPS using the SSL checker to avoid irreversible browser preload list inclusion with broken child hosts.

Header Check Severity Weights

Why Does My Scan Show Different Headers Than DevTools?

Browser extensions, corporate proxies, and local VPN clients sometimes modify headers visible only in your browser session. The remote checker reflects server-side responses from ScanSuite infrastructure.

Cached CDN edge responses may serve stale headers briefly after deploy. Purge CDN cache or append a cache-busting query parameter, then rescan after propagation completes.

Why Did the Scan Fail to Connect?

Private intranet hosts, localhost URLs, and IP addresses blocked by firewalls are unreachable from public scanners. Use curl locally or scan a publicly routable staging mirror.

Aggressive bot protection may return 403 responses without security headers. Whitelist scanner IPs temporarily or inspect headers on an unprotected health-check endpoint.

More on this topic

• Security Headers Generator — Generate HSTS and anti-clickjacking config for Nginx, Apache, Netlify, and Vercel.
• CSP Generator — Build Content Security Policy headers to resolve critical CSP scan failures.
• SRI Generator — Add Subresource Integrity hashes alongside CSP script-src restrictions.
• SSL Checker — Validate TLS certificates and cipher suites before enforcing HSTS preload.
• CORS Checker — Test cross-origin resource sharing policies on API endpoints.

Frequently Asked Questions

Summary

ScanSuite's free security headers checker remotely analyzes live websites for HSTS, CSP, X-Frame-Options, and related directives, delivering graded scores, severity-weighted findings, and copy-paste recommendations. Scan, fix with the headers generator, and export JSON audit reports.