Security headers analyzer
Grade any site's security headers A+ to F — plus an attacker-view scan of its HTML for smuggling patterns and risky scripts.
The URL is fetched once by our server for analysis; nothing is stored
About this tool
Security headers, graded — plus the attacker view
Most scanners stop at headers. This one also reads the page HTML the way an attacker would: in-browser file assembly (the HTML-smuggling pattern of Blob URLs plus forced downloads), navigable data: URIs, scripts without integrity hashes, and macro-lure keywords. Headers are graded A+ to F; every finding explains what it means in plain language.
Frequently asked questions
What does the security headers scan check?
HSTS, Content-Security-Policy, clickjacking defenses, MIME-sniffing, referrer and permissions policies, cross-origin isolation, cookie flags, version disclosure, and HTTP-to-HTTPS redirects — graded A+ to F.
What is the attacker-view detection scan?
Beyond headers, the scanner reads the page HTML the way an attacker would: in-browser file assembly (HTML smuggling patterns), risky URI schemes, scripts without integrity hashes, and macro-lure keywords — each with match counts and samples.
Can I scan localhost or internal sites?
No. Private ranges, localhost, metadata endpoints, non-default ports, and non-HTTP schemes are blocked to prevent abuse. Only public http(s) websites on ports 80/443.