Free tool · No sign-up · Server-assisted
Security Headers Scanner
Fetch a URL and grade the security headers it returns: Content-Security-Policy, Strict-Transport-Security, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy. Each one is explained in a sentence, with the header to add when it is missing, and the whole set rolls up to a letter grade.
Server-assisted · we fetch the URL from our server and send back only the headers it returns
Method & assumptions
- This is one of three server-assisted tools: your browser cannot read another origin's response headers, so our server fetches the URL and returns only its headers.
- The URL you enter is the only thing sent, and only to our server, which then requests it once. Nothing is stored.
- The grade weights the headers that matter most — CSP, HSTS, and framing protection carry more than the rest.
- We follow redirects to a public address only; private and internal targets are refused.
Plate —Other tools
More on the bench
- 01Supabase Security AuditorPoint it at your project, find the holes.
- 02JWT DecoderPaste a token, read what is inside.
- 03Secret & .env ScannerPaste code or a .env, catch the leaked keys.
- 04CORS TesterSee exactly what a URL allows cross-origin.
- 05Base64 Encode / DecodeText or files, both directions.
- 06URL Encode / DecodePercent-encoding, both directions.
- 07JSON FormatterValidate, pretty-print, or minify.
- 08UUID Generatorv4 and v7, one or a thousand.
Free diagnosticsSame-day dispatchNamed techniciansDone or free
Need it built, not just checkedWe write the software
We write the software
behind tools like these
Anyone hardening a site and wanting the same report a pen-tester would open with.