SecurityHeaders.com Alternative: Grade Your HTTP Security Headers
Looking for securityheaders.com? The tool above grades the same response headers (CSP, HSTS, X-Frame-Options, Referrer-Policy, Permissions-Policy and more) and adds cookie flags, the HTTP-to-HTTPS redirect and version leaks, with an A+ to F grade. It is free and needs no account.
SecurityHeaders.com, created by Scott Helme and now part of Snyk, is still a fast free scanner. The biggest practical difference today is the API: its key page says the service has been discontinued for new subscriptions.
Enterno.io vs SecurityHeaders.com
| Feature | Enterno.io | SecurityHeaders.com |
|---|---|---|
| Price | Free on the site · paid plans from $5/mo | Free web scan |
| Free plan | Yes, no sign-up; per-minute rate limit | Yes, no sign-up; scans listed publicly unless hidden |
| API | REST API v4 "security"; 200 requests/day free | Key-only API; no new subscriptions or renewals |
| Grades | A+ to F with a 0 to 100 score | A+ to F, plus R for a redirect response |
| Scope | Headers, cookie flags, HTTPS redirect, version leaks | Response headers; Server and X-Powered-By as info |
| Redirects | Grades the final response after redirects | Optional "Follow redirects" checkbox |
| Alert on grade drop | Daily re-scan of monitored URLs on Captain | Not offered on the site |
Free online tool — website security scanner: instant results, no signup.
What the grader above checks
- Headers: Content-Security-Policy, Strict-Transport-Security with a preload check, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, Cross-Origin-Opener-Policy, Cross-Origin-Embedder-Policy and Cross-Origin-Resource-Policy.
- Cookie flags: Secure, HttpOnly and SameSite, including cookies set during same-site redirects.
- HTTPS enforcement: does plain HTTP redirect to HTTPS?
- Information disclosure: Server, X-Powered-By and ASP.NET version strings.
The scan follows redirects and grades the page the visitor actually lands on, and warns when a WAF challenge answered instead of your origin. For a line-by-line review of a policy, use the CSP analyzer; to see raw headers, use HTTP headers.
Where SecurityHeaders.com is better
- Speed and focus. One input, one grade, the missing headers in a list. If all you want is a header grade for a quick fix, it is hard to beat.
- Reach. Its home page counted more than 401 million scans when we checked, so its grades are widely recognised in audits and bug reports.
- Explanations. Its report format, shown in its API docs, explains each header with links to Scott Helme's articles and lists upcoming headers worth adding.
- Redirect control. A checkbox lets you grade the redirect response itself (grade R) or follow it to the final page.
One thing to know: recent scans are listed publicly on its home page unless you tick "Hide results" before scanning.
The API question
SecurityHeaders.com's API needs a key in an x-api-key header, and its API key page now says: "This service has been discontinued. We are no longer providing new subscriptions or renewing existing subscriptions." Existing keys can still be managed there.
If you need header grades in a pipeline, two options remain:
- Enterno REST API v4, tool
security, on every plan; the free Scout plan includes 200 API requests a day. AI agents can callcheck_securityover MCP. - MDN's HTTP Observatory v2 API, free and keyless, limited to one new scan per host per minute; compared on our Mozilla Observatory page.
Checking headers without any tool
For a quick look you do not need a grader at all. curl shows the raw response headers, and -L follows redirects the way a browser does:
curl -sIL https://example.com | grep -iE "strict-transport|content-security|x-frame|x-content-type|referrer-policy|permissions-policy"A grader adds what curl cannot: it judges values, not just presence. A Content-Security-Policy with 'unsafe-inline' in script-src, or HSTS with a short max-age, is present but weak. Our grader marks both down, and SecurityHeaders.com warns about 'unsafe-inline' too. Automate with curl -H "X-API-Key: YOUR_KEY" "https://enterno.io/api/v4/security?url=https://example.com".
Why the grades will not match exactly
The two tools score differently. SecurityHeaders.com's FAQ says your score reflects how many security-related response headers your site issues, and an A+ needs all the headers it checks for. Our grade weighs headers together with cookie flags, the HTTPS redirect and version leaks, so a site with perfect headers and an insecure session cookie scores lower here. Pick one tool for tracking, and fix by finding rather than by grade.
To catch regressions, the Captain plan re-scans monitored URLs daily and alerts in Telegram or Slack when the grade drops by a letter.
Why teams trust us
How it works
Enter site URL
Security headers analyzed
Get grade A–F
What Does the Security Analysis Check?
The tool checks HTTP security headers, SSL/TLS configuration, server info leaks, and protection against common attacks (XSS, clickjacking, MIME sniffing). A grade fromA to F shows overall security level.
Header Analysis
Checking Content-Security-Policy, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and more.
SSL Check
TLS version, certificate expiry, chain of trust, HSTS support.
Leak Detection
Finding exposed server versions, debug modes, open configs, and directories.
Report with Recommendations
Detailed report explaining each issue with specific steps to fix it.
Who uses this
Security teams
HTTP header audit
DevOps
config verification
Developers
CSP & HSTS setup
Auditors
compliance checks
Common Mistakes
Strict-Transport-Security.Server: Apache/2.4.52 helps attackers find exploits. Hide the version.DENY or SAMEORIGIN.nosniff, browsers may misinterpret file types (MIME sniffing).Best Practices
Content-Security-Policy-Report-Only, monitor violations, then enforce.Server, X-Powered-By, X-AspNet-Version from responses.Get more with a free account
Security check history and HTTP security header monitoring.
Sign up freeLearn more
How-to
Glossary
Research
Frequently Asked Questions
Is SecurityHeaders.com still free?
Yes, the web scan is free and needs no account. Its paid API is a different matter: the API key page says new subscriptions and renewals are no longer offered.
Who runs SecurityHeaders.com?
Snyk. Its About page says the site is part of Snyk and was originally created by Scott Helme, who still provides input.
Will I get the same grade on Enterno?
Not always. SecurityHeaders.com grades headers only. Enterno also scores cookie flags, the HTTP-to-HTTPS redirect and version leaks, so the same site can land a grade higher or lower.
Can I keep my scan private?
On SecurityHeaders.com, tick "Hide results" before scanning, or your domain can appear in the public Recent Scans list.
How do I monitor security headers continuously?
On the Captain plan, URLs you monitor are re-scanned daily and you get a Telegram or Slack alert when the grade drops by a letter. On any plan you can call the security tool from REST API v4 in your own scheduler.
Try the live tool that powered this guide
Free plan — 10 monitors, checks every 5 min, no card required. Upgrade for 1-minute interval and multi-region monitoring.