Grade the security headers protecting your site
Scan a URL for the response headers that stop clickjacking, XSS and protocol downgrade — see which are present, which are missing, and exactly how each one is configured.
Runs in the Website Inspector — no account, nothing to install.
Sample report · illustrative data
Everything the report surfaces
CSP inspection
Parses Content-Security-Policy directive by directive, flagging unsafe-inline, wildcard sources and missing fallbacks that weaken protection.
HSTS & transport
Checks Strict-Transport-Security for max-age, includeSubDomains and preload so downgrade attacks and mixed content are ruled out.
Framing & isolation
Verifies X-Frame-Options and frame-ancestors, plus Cross-Origin isolation headers that defend against clickjacking and side-channel leaks.
Referrer & permissions
Reviews Referrer-Policy and Permissions-Policy to confirm the browser is told how much to share and which powerful features to allow.
Three steps to a full answer
Enter your URL
Point the scanner at any public page — a homepage, an API root or a specific route.
We inspect the response
The Website Inspector fetches the page and evaluates each security header against current best practice.
Fix what is flagged
Every missing or weak header comes with the recommended value and a link to the reference page explaining why it matters.
Grade the security headers protecting your site
Open the Website Inspector and get your answer in seconds.
Go deeper in the reference library
Common questions
Which security headers are checked?
Content-Security-Policy, Strict-Transport-Security, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy and the Cross-Origin isolation headers (COOP, COEP, CORP).
Why do missing security headers matter?
Each header instructs the browser to block a class of attack — clickjacking, cross-site scripting, protocol downgrade or data leakage. When a header is absent the browser falls back to permissive defaults, leaving the gap open.
Will it tell me how to fix a weak header?
Yes. For every flagged header the scanner shows the recommended configuration and links to a reference page that explains the directives in detail.
Does scanning change anything on my site?
No. The scanner only reads the response your server already sends. It makes standard GET requests and never modifies your configuration.