What is a security headers checker?

A tool that remotely fetches a URL and analyzes HTTP response headers for security best practices, scoring and recommending fixes.

How is the security score calculated?

Each header check has a severity weight; pass earns full points, warn earns half, fail earns zero, summed into a percentage grade.

What letter grades are assigned?

A+ at 90%+, A at 80%+, B at 70%+, C at 60%+, D at 50%+, and F below 50%.

Can I scan any website?

You can scan public URLs; only test domains you own or have explicit permission to assess.

Why is missing CSP marked critical?

Content-Security-Policy is the primary modern defense against cross-site scripting and unauthorized script execution.

What HSTS configuration passes the checker?

max-age of at least 31536000 seconds with includeSubDomains present in the Strict-Transport-Security value.

Why does X-XSS-Protection show as deprecated?

Modern browsers deprecate this header in favor of Content-Security-Policy; its presence is informational only.

Can I export scan results?

Yes, download a JSON report containing URL, timestamp, header checks, score, and grade for audit records.

Does the checker follow redirects?

Yes, redirects are followed so final response headers on the destination URL are analyzed.

Why is Permissions-Policy missing marked info severity?

Permissions-Policy is recommended but lower priority than CSP, HSTS, and anti-clickjacking headers on most sites.

How do I fix a failed X-Frame-Options check?

Add X-Frame-Options: DENY or SAMEORIGIN via your server config or use the security headers generator.

Can I scan localhost or internal IPs?

No, the scanner runs remotely and cannot reach private network addresses or localhost.

How often should I scan production sites?

Scan after every deploy affecting headers and schedule weekly or monthly regression checks.

Does a high grade mean my site is fully secure?

No, header grades cover HTTP response hardening only; TLS, application logic, and auth require separate testing.

What is the difference between this checker and the headers generator?

The generator creates config snippets to deploy headers; the checker verifies live sites already return them correctly.

Why warn on CSP unsafe-inline?

unsafe-inline weakens XSS protection by allowing inline scripts; nonces or hashes are preferred in strict policies.

Is the security headers checker free?

Yes, ScanSuite offers free unlimited remote header scans without registration.

Should I combine this with other ScanSuite tools?

Yes, use the SSL checker for TLS, CORS checker for cross-origin APIs, and CSP generator for policy authoring.

What Referrer-Policy values pass the checker?

no-referrer, strict-origin, strict-origin-when-cross-origin, and same-origin are accepted as passing configurations.

Free Security Headers Checker — Scan Website

A security headers checker performs remote HTTP requests against a target URL, inspects response headers for protective directives such as HSTS, Content-Security-Policy, X-Frame-Options, and Referrer-Policy, assigns pass or fail status per header, calculates an aggregate security score with letter grade, and surfaces actionable recommendations to improve website hardening.

Enter any public HTTPS URL into ScanSuite's security headers checker, run the scan, and receive a graded report showing which security headers are present, misconfigured, or missing—with copy-paste fix recommendations and optional JSON export for audit records.

Deploying HTTP security headers is only half the battle; teams must continuously verify that load balancers, CDNs, and deployment pipelines actually deliver those directives on every response. A remote security headers checker fetches live pages exactly as browsers do, exposing gaps between intended policy and production reality.

ScanSuite's free security headers checker analyzes public URLs for Strict-Transport-Security, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, and legacy X-XSS-Protection. Each header receives a pass, warning, or fail status with severity weighting that rolls up into a percentage score and letter grade from A+ through F.

ScanSuite's free security headers checker remotely analyzes live websites for HSTS, CSP, X-Frame-Options, and related directives, delivering graded scores, severity-weighted findings, and copy-paste recommendations. Scan, fix with the headers generator, and export JSON audit reports.

Frequently Asked Questions

What is a security headers checker?: A tool that remotely fetches a URL and analyzes HTTP response headers for security best practices, scoring and recommending fixes.
Which headers does ScanSuite check?: HSTS, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, and deprecated X-XSS-Protection.
How is the security score calculated?: Each header check has a severity weight; pass earns full points, warn earns half, fail earns zero, summed into a percentage grade.
What letter grades are assigned?: A+ at 90%+, A at 80%+, B at 70%+, C at 60%+, D at 50%+, and F below 50%.
Can I scan any website?: You can scan public URLs; only test domains you own or have explicit permission to assess.
Why is missing CSP marked critical?: Content-Security-Policy is the primary modern defense against cross-site scripting and unauthorized script execution.