🔐 Security Score
Rule-based, from real headers––/100
Not scanned yet
Run a check to see this site's security header score.
🔐 Security Headers Checker
Check Security Headers Instantly 🛡️
Analyze HTTP security headers, review missing protections, and understand how well a website is protected against common browser-based vulnerabilities — fetched and scored by our own backend, never faked in the browser.
✨
✦
⭐
?
🔒
Ready to scan
Enter a URL and run a check to review its headers.
Total Headers
–DetectedPassed
–GoodWarnings
–ReviewMissing
–Important🧾 Security Headers Overview
| Header | Status | Value | Description |
|---|---|---|---|
| Run a check to see this site's security headers. | |||
🛡️ Security Grade
A–F?
Not scanned yet
Run a check to see this site's overall security grade.
FDCBA
📊 Header Strength Distribution
Of scored headers–Strong
Passed–
Warnings–
Missing–
🌐 Protocol & Connection
Real, measured🔒 HTTPS–
⚙️ HTTP Version–
🚀 HSTS Preload–
🧬 TLS Version–
🛰️ Forward Secrecy–
🍪 Cookie Flags–
ℹ️ About Security Headers
ReferenceSecurity headers are HTTP response headers that help protect a website from common attacks and browser-related vulnerabilities.
🛡️ Protect against XSS attacksYes
🖱️ Prevent clickjackingYes
🔐 Enforce secure content policiesYes
🌍 Control resource loadingYes
🚦 Enforce HTTPS connectionsYes
💡 Security Recommendations
Run a check to get recommendations.
📦 Report Actions
💡 Tip: Re-check headers regularly to maintain security and catch configuration regressions early.
HOW IT WORKS
A Real Header Scan, Not a Demo
Check fetches the target URL from our own server with the same SSRF protections used across our tools (private/loopback/link-local/metadata addresses are always rejected), following redirects to see whether HTTP is upgraded to HTTPS. It inspects 16 real response headers, parses Set-Cookie flags, and independently opens a TLS connection to read the negotiated protocol version and cipher suite — including whether that cipher suite provides forward secrecy. The score and grade are computed from these real signals, never randomly generated.
Security Headers Checker FAQ
Is Forward Secrecy really measured?
Yes. It's read from the real TLS handshake's negotiated cipher suite: TLS 1.3 suites are always forward-secret, and for TLS 1.2 it's true only for (EC)DHE key-exchange suites.
Why is the Server header "informational" and not scored?
Disclosing or hiding server software is a deliberate choice either way — it's shown for reference but doesn't count toward the pass/warning/missing summary.
Are deprecated headers like X-XSS-Protection penalized?
They're scored the same way modern scanners commonly present them, but the description for each explains plainly that it's legacy, so the number doesn't overstate real risk.
Can I check internal or private URLs?
No. Requests that resolve to localhost, private IP ranges, link-local addresses or cloud metadata endpoints are rejected before any fetch happens.
Is my scanned data stored?
No. Each scan runs live for your request only. The exported report is generated and downloaded entirely in your browser.