Security Headers Checker

Headers analyzed, not just listed

CSP directive depth, live HSTS preload verification, and a CWE/OWASP reference for every finding - the deepest single check Scanverra runs.

Check my headers free

The core headers, at a glance

Header	What it does	CWE
Content-Security-Policy	Restricts which scripts, styles, and resources can load	CWE-693
Strict-Transport-Security	Forces HTTPS, blocking protocol-downgrade attacks	CWE-319
X-Frame-Options	Prevents your site being framed for clickjacking	CWE-1021
X-Content-Type-Options	Stops browsers from MIME-sniffing responses	-
Referrer-Policy	Controls what's sent in the Referer header to other sites	-
Permissions-Policy	Restricts access to browser features like camera and geolocation	-

What "analyzed" actually means here

CSP directive analysis

Not just "is a CSP present" - checks base-uri, form-action, object-src, and frame-ancestors individually, and flags overly broad wildcard sources.

Live HSTS preload verification

Checks your HSTS max-age and includeSubDomains settings, then makes a live check against the browser HSTS preload list to confirm whether your domain is actually preloaded, not just configured to request it.

Deprecated header detection

Flags headers like X-XSS-Protection that browsers have deprecated and no longer honor, so you're not relying on protection that no longer exists.

How it works

One scan, every header, real analysis.

Paste your URL

An external check against your live response headers - the same headers any visitor's browser receives.

Every header analyzed

Presence, configuration depth, and known weaknesses - not a simple present/missing checklist.

Fixes with exact header values

Each finding comes with a CWE identifier, an OWASP Top 10 category, and a specific recommended header value to set.

FAQ

Frequently asked questions

Listing which headers are present is easy. Analyzing whether a Content-Security-Policy is actually restrictive, whether your HSTS header is genuinely preloaded (not just configured), and mapping each gap to a specific CWE and OWASP category is the part most header checkers skip.

CWE (Common Weakness Enumeration) is a standard identifier for a class of security weakness; OWASP Top 10 is a widely-referenced list of the most critical web application security risks. Mapping findings to both makes them easier to communicate to a security team or auditor who already works in that vocabulary.

Yes - it makes a live check against the browser HSTS preload list, so you get a real answer, not just whether your header includes the word "preload."

It can, if rolled out carelessly - a too-strict CSP can silently block your own scripts, analytics, or payment provider. See the CSP guide linked below for a safe rollout strategy using report-only mode before enforcing.

Related audits

Website Audit

Run a free instant audit for performance, SEO, accessibility, and best practices.

SEO Audit

Check crawlability, metadata, structured data, and AI-agent discoverability.

Performance Audit

A full lab performance audit across desktop and mobile, with framework-aware fixes.

Accessibility Audit

See exactly which WCAG 2.1/2.2 success criteria your site fails, and why.

Security Audit

Turn a header/vulnerability scan into SOC 2 and GDPR control evidence.

Website Speed Audit

How fast your site loads, in plain language - one number, no jargon.

Core Web Vitals Audit

Check LCP, CLS, and INP against Google's thresholds, lab and field.

Broken Link Checker

Crawl a page's links and find the ones that are dead before your users do.

Open Graph Checker

See whether your page has the og:title, og:description, and og:image tags social platforms need.

Schema Markup Checker

Check whether your page ships JSON-LD structured data search engines and AI agents can read.

Sitemap Checker

Check whether your sitemap.xml is reachable, valid, and free of common mistakes.

Redirect Checker

Trace a URL's redirect chain and catch loops, excess hops, and HTTPS-to-HTTP downgrades.

SSL Checker

Test your SSL certificate for expiry, hostname match, chain trust, TLS version, key strength and HSTS in seconds.

Color Contrast Checker

Calculate the WCAG contrast ratio of any two colors and see AA and AAA results, with a suggested accessible color.

Website Technology Checker

Find out which CMS, framework, ecommerce platform and libraries a website is built with.

robots.txt Checker

Check syntax, sitemap lines and size limits, and test whether Googlebot or any crawler can access a URL.

Canonical Checker

Find missing, duplicate, relative or conflicting canonical tags and check that the canonical URL loads.

Hreflang Checker

Validate language codes, x-default and self-references, and confirm every alternate page links back.

Meta Tag Checker

Check title tags, meta descriptions, H1 headings, robots, viewport and Open Graph tags on any page.

HTTP Status Checker

Check up to 20 URLs at once for 200, 301, 404 and 500 responses and redirect chains.

CSP Evaluator

Check a Content-Security-Policy for unsafe-inline, unsafe-eval, wildcards, missing object-src and base-uri, from a URL or pasted policy.

Mixed Content Checker

Find http:// scripts, stylesheets, iframes and images on HTTPS pages that browsers block or warn about.

Alt Text Checker

Find images with missing, empty, file-name or overly long alt text on any page, for accessibility and image SEO.

API Key Leak Checker

Scan a website's public HTML and JavaScript for exposed API keys, tokens and secrets.

MCP Security Scanner

Find unpinned MCP servers, leaked tokens and risky agent settings in your repo.

Vibe Coding Security

Check AI-written code for secrets, injection flaws and risky dependencies.

ADA Compliance Checker

Test your site against the WCAG criteria ADA cases reference.

EAA Compliance Checker

Check your site against the WCAG basis of the European Accessibility Act.

For Agencies

Audit client sites for SEO, speed, accessibility and security on one team plan.

Fix guides

Fix missing security headers

Fix mixed content warnings

All how-to guides

Check your security headers for free

CSP depth, HSTS preload verification, and CWE/OWASP mapping.

Run free audit