Free tool
Security Headers Checker
Enter any public URL. We fetch it once from our edge, read the response headers and grade them, with the exact fix for each missing header. Nothing is stored.
Result for
| Header | Status | Value or fix |
|---|
Headers protect against clickjacking, sniffing and some XSS. They do not find injection flaws, broken access control or SSRF in your code or APIs.
Go deeper than headers
Test the application behind the headers
Offensive360 DAST crawls the running app with a headless browser and runs 40+ active checks with request and response proof for every finding. On-premise, Azure or fully air-gapped.
Questions
What does this tool check?
It requests your page once, reads the response headers and grades seven security headers: Strict-Transport-Security, Content-Security-Policy, X-Content-Type-Options, X-Frame-Options (or a CSP frame-ancestors directive), Referrer-Policy, Permissions-Policy and Cross-Origin-Opener-Policy. It also flags headers that leak server or framework versions, and the legacy X-XSS-Protection header.
How is the grade calculated?
Each header has a weight that reflects how much protection it adds. CSP and HSTS count most. The score is the weighted share of passing checks, minus a small penalty for version-leaking headers. A is 90 or above, B is 75, C is 55, D is 35, F is below.
Does a good grade mean my application is secure?
No. Headers are defence in depth against clickjacking, content sniffing, some cross-site scripting and downgrade attacks. They do not find SQL injection, broken access control, SSRF or insecure APIs. For that you need static analysis of the code and dynamic testing of the running application.
Is anything stored?
The check runs from our edge network, reads only headers, never the page body, and keeps nothing except an anonymous rate-limit counter. Results are shown to you and discarded.
Why is my Content-Security-Policy marked as failing?
A policy whose script-src allows unsafe-inline gives little protection against cross-site scripting, so the check fails it. Use nonces or hashes for inline scripts, and start with Content-Security-Policy-Report-Only while you tune the policy.