Free tool · Live scan
Website Security Header Scanner
Paste your website address and get a 0–100 score for the browser-enforced protections it ships — HTTPS, HSTS, Content-Security-Policy, clickjacking and MIME defenses, cookie flags — with a plain-English fix for every gap. No email, no signup, results in seconds.
How the math works
Nine weighted checks, all from one public request.
The scanner sends a single normal GET request — the same thing a browser does — and grades the response. HTTPS is worth 20 points and Content-Security-Policy 20, because they defend against the two most damaging classes of attack (interception and script injection). HSTS is worth 12; clickjacking protection 10; MIME sniffing, referrer, permissions, cookie flags, and technology disclosure make up the remaining 38. Partial credit is given where a header exists but is weakened — a CSP with unguarded unsafe-inline, an HSTS max-age under six months, cookies missing flags.
What it deliberately is not: a penetration test, a vulnerability scan, or a code review. It reads headers on one URL, follows at most three redirects, refuses private and internal addresses, and never inspects page content. Treat the score as a measure of one defense layer — the cheapest one to fix.
What to do with the number
A score is a to-do list. Here's how to work it.
Score under 65?
The fixes are configuration, not a rebuild — most are one line on the server or CDN. If nobody on your side owns that layer, that's the actual finding. We can fix the headers and tell you what else the score can't see.
Talk to an engineerWondering what a real incident looks like?
We wrote a field guide to a small business's first 72 hours after a compromise — what actually happens, what it costs, and what would have prevented it.
The first 72 hours after a hackWant more than headers checked?
Our cybersecurity analysis reviews the layers a header scan can't reach: access controls, credential handling, backups, and the systems your customer data actually lives in.
Cybersecurity analysisFrequently asked questions
Asked before the calculator, usually.
What exactly does this scanner check?
It sends one normal web request to the address you enter and reads the publicly visible HTTP response headers: HTTPS, Strict-Transport-Security, Content-Security-Policy, clickjacking protection, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, cookie Secure/HttpOnly flags, and version-revealing headers. Each carries a weight toward the 0–100 score, and every result explains what to change.
Is this a penetration test?
No, and it's important to be clear about that. This is a limited external configuration check — the same information any browser receives when it loads your site. It cannot see your code, your database, your access controls, or your business logic. A perfect header score does not mean a site is secure; it means one specific layer of defense is configured.
My score is low. How urgent is this, really?
Most header fixes are one-line server or CDN settings, so the effort-to-benefit ratio is unusually good — that's the honest reason to act, not panic. HTTPS and HSTS failures matter most, especially if customers log in or submit forms. Missing CSP matters more the more third-party scripts a site runs. If the site is a plain brochure with no logins, a mediocre score is a housekeeping item, not an emergency.
Can I scan any website?
The scanner only reads public response headers, which any visitor's browser already receives — but you should scan sites you own or administer, because the point is to fix what it finds. It refuses internal hostnames and private network addresses, follows at most three redirects, and rate-limits repeated scans.
Go deeper: the first 72 hours after a small business is hacked, our cybersecurity analysis service, software modernization, and all free tools.
Headers are the surface. Want the layers underneath checked?
Send us your scan result. We'll tell you which gaps matter for your specific site, fix the configuration, and flag anything deeper worth a real look — at a fixed price, as always.