Skip to content
Skip to content

🔒 Security Scanner

Analyze your website security: headers, HTTPS, cookies, and information disclosure checks

🛡
HeadersCSP, HSTS, X-Frame-Options, etc.
🔒
SSL/TLSEncryption and certificate
🔧
ConfigurationServer settings and leaks
🎯
Grade A-FOverall security score

What Does the Security Analysis Check?

The tool checks HTTP security headers, SSL/TLS configuration, server info leaks, and protection against common attacks (XSS, clickjacking, MIME sniffing). A grade from A to F shows overall security level.

🛡

Header Analysis

Checking Content-Security-Policy, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and more.

🔒

SSL Check

TLS version, certificate expiry, chain of trust, HSTS support.

🔎

Leak Detection

Finding exposed server versions, debug modes, open configs, and directories.

📋

Report with Recommendations

Detailed report explaining each issue with specific steps to fix it.

Common Mistakes

Missing Content-Security-PolicyCSP is the primary XSS defense. Without it, script injection is much easier.
Missing HSTS headerWithout HSTS, HTTPS-to-HTTP downgrade attacks are possible. Enable Strict-Transport-Security.
Server header exposes versionServer: Apache/2.4.52 helps attackers find exploits. Hide the version.
X-Frame-Options not setSite can be embedded in iframe for clickjacking. Set DENY or SAMEORIGIN.
Missing X-Content-Type-OptionsWithout nosniff, browsers may misinterpret file types (MIME sniffing).

Best Practices

Start with basic headersMinimum: HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy. Takes 5 minutes.
Implement CSP graduallyStart with Content-Security-Policy-Report-Only, monitor violations, then enforce.
Hide server headersRemove Server, X-Powered-By, X-AspNet-Version from responses.
Configure Permissions-PolicyRestrict camera, microphone, geolocation access — only what is actually used.
Check after every deploySecurity headers can be overwritten during server configuration updates.

Website Security Check

The security check tool analyzes HTTP response headers and evaluates the website protection level. Key security headers are checked: Strict-Transport-Security (HSTS), Content-Security-Policy (CSP), X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy.

Use this tool to audit security headers before launching a website, after server migration, or as part of regular security reviews. Each header is scored individually, and you receive a total security grade from A+ to F. The tool checks for common misconfigurations such as missing HSTS, overly permissive CSP, missing clickjacking protection, and outdated X-XSS-Protection headers.

For deeper analysis, combine with our SSL certificate checker to verify TLS configuration and HTTP headers reference to understand each header's purpose. Regular security header monitoring helps maintain compliance with OWASP recommendations and protects your users from XSS, clickjacking, and data injection attacks.

Frequently Asked Questions

Which security headers are most important?

Top 5 essential headers: Content-Security-Policy (XSS protection), Strict-Transport-Security (forced HTTPS), X-Content-Type-Options (nosniff), X-Frame-Options (clickjacking protection), Permissions-Policy (API restrictions).

How to add security headers?

In nginx, add add_header in the server block. In Apache, use Header set in .htaccess or config. In PHP, use the header() function. For Cloudflare, use Transform Rules. Verify the result with our tool after configuration.

What does a high security score give?

A high security score means your site is protected against major web vulnerabilities. This increases user trust, improves SEO (Google considers HTTPS and headers), and reduces the risk of hacking and data leaks.

What is Content-Security-Policy?

CSP is a header that defines where the browser can load resources from (scripts, styles, images). Primary protection against XSS attacks. Example: default-src 'self' blocks all external resources.

How to protect a site from clickjacking?

Use the X-Frame-Options: DENY or SAMEORIGIN header to prevent embedding your site in iframes on other domains. The modern alternative is CSP with the frame-ancestors directive.

Why is X-Content-Type-Options needed?

The X-Content-Type-Options: nosniff header prevents the browser from "guessing" the MIME type of a file. Without it, the browser may interpret a text file as a script, creating a vulnerability to MIME-sniffing attacks.

What is Permissions-Policy?

Permissions-Policy (formerly Feature-Policy) is a header that controls access to browser APIs: camera, microphone, geolocation, autoplay. It is recommended to disable unused APIs to minimize the attack surface.