Web & API Security Tool Free Interactive Tool · Zero Logging
Audit HSTS, CSP, X-Frame-Options, Referrer-Policy, Permissions-Policy, and CORS with a shareable letter grade. Free HTTP security headers and Content-Security-Policy (CSP) checker. Get an instant 0–100 score, shareable A+ to F letter grade, and copy-paste header fixes.
Paste a JSON map of HTTP response headers (or provide a public HTTPS url) and click Run Live Tool.
Powered by HTTP Security Header Scanner API (POST /v1/security-headers).
{
"ok": true,
"data": {
"target_url": null,
"http_status": null,
"score": 55,
"grade": "D",
"checks": {
"hsts": {
"status": "pass",
"score": 25,
"max_score": 25,
"value": "max-age=63072000; includeSubDomains; preload",
"issues": [],
"fix": null
},
"csp": {
"status": "fail",
"score": 0,
"max_score": 25,
"value": null,
"issues": [
"Missing Content-Security-Policy header"
],
"fix": "default-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'"
},
"x_content_type_options": {
"status": "pass",
"score": 15,
"max_score": 15,
"value": "nosniff",
"issues": [],
"fix": null
},
"frame_protection": {
"status": "pass",
"score": 15,
"max_score": 15,
"value": "DENY",
"issues": [],
"fix": null
},
"referrer_policy": {
"status": "fail",
"score": 0,
"max_score": 10,
"value": null,
"issues": [
"Missing Referrer-Policy header"
],
"fix": "strict-origin-when-cross-origin"
},
"permissions_policy": {
"status": "warn",
"score": 0,
"max_score": 10,
"value": null,
"issues": [
"Missing Permissions-Policy header"
],
"fix": "geolocation=(), microphone=(), camera=()"
}
},
"cors": {
"allow_origin": null,
"allow_credentials": null,
"wildcard": false,
"misconfigured": false
},
"fixes": [
{
"header": "Content-Security-Policy",
"priority": "high",
"recommended_value": "default-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'"
},
{
"header": "Referrer-Policy",
"priority": "medium",
"recommended_value": "strict-origin-when-cross-origin"
},
{
"header": "Permissions-Policy",
"priority": "low",
"recommended_value": "geolocation=(), microphone=(), camera=()"
}
]
},
"meta": {
"request_id": "req_sh_01",
"ms": 1
}
}
This browser tool runs on the exact same stateless Cloudflare Worker microservice as our production APIs. Subscribe on RapidAPI or Zyla API Hub to unlock up to 256 KB payloads and 500,000 monthly requests:
POST /v1/security-headers
Security & Secrets
Audit CSP, HSTS, and browser security headers with an A+ to F grade and fix snippets.