Security Header Checker
Enter a public URL to read the HTTP response headers it sends and grade six browser security headers: Strict-Transport-Security, Content-Security-Policy, clickjacking protection, X-Content-Type-Options, Referrer-Policy and Permissions-Policy, plus a note on server technology disclosure. You get a grade, a fix for each gap and a downloadable checklist. It reads headers only and is not a vulnerability scan.
Browser + server request
Free, no sign-up. The site you enter is looked up by a server, not your browser: the host name (no path) goes to the third-party HackerTarget header lookup, or the full address goes to SMNIFY's own lookup proxy when one is configured. Grading and exports run in your browser.
This reads the response headers a site already sends publicly. Nothing is attacked or exploited. The host name you enter is sent to a third-party header lookup service to fetch them.
How to use the Security Header Checker
- Type the public address of the site, for example https://yourwebsite.com, into the box.
- Press Scan. A lookup service fetches the response headers for the site's host and returns them.
- Read the Security Headers Grade and the list of findings, each marked pass, warning or fail with a Fix line for anything not passing.
- Press Download findings (JSON) for the raw result, or Download remediation checklist (Markdown) to hand to whoever runs the server.
- Apply the fixes in your web server, CDN or framework config and scan again.
How it works
The headers this tool checks
Strict-Transport-Security (HSTS) tells browsers to use HTTPS only. It passes with a max-age of at least 15,552,000 seconds (six months). Content-Security-Policy limits where scripts and other resources may load from, which reduces the impact of injected scripts; a report-only policy counts as a warning because it monitors but does not block.
Clickjacking protection passes if X-Frame-Options or a CSP frame-ancestors directive stops other sites embedding the page. X-Content-Type-Options: nosniff stops browsers guessing a file's type. Referrer-Policy controls how much of the page address is sent to other sites. Permissions-Policy (or the older Feature-Policy) switches off browser features such as camera or geolocation.
Technology disclosure checks whether Server or X-Powered-By advertise your stack. It is advisory and carries the lowest weight.
How the grade is calculated
Each finding has a weight: CSP 25, HSTS 20, clickjacking 15, X-Content-Type-Options 12, Referrer-Policy 12, Permissions-Policy 10, disclosure 6. A pass earns the full weight, a warning half, a failure nothing. The percentage maps to a letter: 95 and above A+, 85 A, 75 B, 60 C, 45 D, below that F.
score = round(100 x (pass weights + 0.5 x warning weights) / total weights)
What a header check cannot tell you
Headers are one layer of defence. A perfect grade says nothing about vulnerable code, weak passwords, outdated software, misconfigured servers or exposed data, and a low grade does not mean the site has been compromised.
That is why this page is a header checker and not a vulnerability scanner. For a security assessment of an application, you need testing that looks at the application itself.
Rolling out a strict policy safely
Add headers in stages. Try Content-Security-Policy-Report-Only first to see what a policy would block, and enable HSTS with a short max-age before raising it, because browsers remember it. Only add the preload directive when every subdomain is served over HTTPS.
Inputs, outputs and limits
Inputs
- A public http or https address
Outputs
- A letter grade and a 0-100 score for the headers checked
- A pass, warning or fail finding with explanation for each header
- A Fix line for every header that is not passing
- Download as JSON findings or as a Markdown remediation checklist
Limits
- Reads response headers only; it does not test application code, TLS configuration, cookies or content.
- One address at a time. The public lookup checks the host only, so the path you type is ignored and headers that differ per page are not seen.
- Localhost and private network addresses are blocked.
- Depends on a third-party lookup service that can be slow or rate-limited.
Processing
- The site you enter is looked up by a server, not your browser: the host name (no path) goes to the third-party HackerTarget header lookup, or the full address goes to SMNIFY's own lookup proxy when one is configured. Grading and exports run in your browser.
Frequently asked questions
Is this a vulnerability scanner?
No. It reads and grades a handful of HTTP response headers. It does not probe your application, look for software flaws or test authentication, so a good grade is not evidence that a site is secure.
Who receives the address I enter?
Only the host name (not the page path) is sent to a third-party lookup service, HackerTarget, so it can request the headers for you; with a configured SMNIFY proxy, the full address goes there instead. Scan only sites you own or are allowed to test, and do not enter addresses that contain secrets.
Why is my CSP only a warning?
If the site sends only Content-Security-Policy-Report-Only, the browser reports violations but blocks nothing. Once you have reviewed the reports, switch to the enforcing Content-Security-Policy header.
My site is behind a CDN. Whose headers are shown?
The ones the lookup service receives, which are the CDN's final responses. If you set headers at the origin and the CDN strips or replaces them, the scan shows what visitors actually get.
Do I need every header to get an A?
Missing headers lower the grade by their weight, and CSP and HSTS count the most. Some pages cannot sensibly use every header, so use the grade as a prompt to decide, not a target to game.
Need help implementing these improvements?
We fix the issues these checks surface: metadata, structured data, performance and security headers, shipped and verified on your stack.