Scanverra
Security Headers Checker

Headers analyzed, not just listed

CSP directive depth, live HSTS preload verification, and a CWE/OWASP reference for every finding - the deepest single check Scanverra runs.

Check my headers free

The core headers, at a glance

HeaderWhat it doesCWE
Content-Security-PolicyRestricts which scripts, styles, and resources can loadCWE-693
Strict-Transport-SecurityForces HTTPS, blocking protocol-downgrade attacksCWE-319
X-Frame-OptionsPrevents your site being framed for clickjackingCWE-1021
X-Content-Type-OptionsStops browsers from MIME-sniffing responses-
Referrer-PolicyControls what's sent in the Referer header to other sites-
Permissions-PolicyRestricts access to browser features like camera and geolocation-

What "analyzed" actually means here

CSP directive analysis

Not just "is a CSP present" - checks base-uri, form-action, object-src, and frame-ancestors individually, and flags overly broad wildcard sources.

Live HSTS preload verification

Checks your HSTS max-age and includeSubDomains settings, then makes a live call to the Chrome HSTS preload list API to confirm whether your domain is actually preloaded, not just configured to request it.

Deprecated header detection

Flags headers like X-XSS-Protection that browsers have deprecated and no longer honor, so you're not relying on protection that no longer exists.

How it works

One scan, every header, real analysis.

Paste your URL

An external check against your live response headers - the same headers any visitor's browser receives.

Every header analyzed

Presence, configuration depth, and known weaknesses - not a simple present/missing checklist.

Fixes with exact header values

Each finding comes with a CWE identifier, an OWASP Top 10 category, and a specific recommended header value to set.

FAQ

Frequently asked questions

Isn't checking security headers something any tool can do?

Listing which headers are present is easy. Analyzing whether a Content-Security-Policy is actually restrictive, whether your HSTS header is genuinely preloaded (not just configured), and mapping each gap to a specific CWE and OWASP category is the part most header checkers skip.

What does "CWE" and "OWASP" mean on my report?

CWE (Common Weakness Enumeration) is a standard identifier for a class of security weakness; OWASP Top 10 is a widely-referenced list of the most critical web application security risks. Mapping findings to both makes them easier to communicate to a security team or auditor who already works in that vocabulary.

Can this tool tell me if I'm on the HSTS preload list?

Yes - it makes a live check against the Chrome HSTS preload list API, so you get a real answer, not just whether your header includes the word "preload."

Will adding a strict CSP break my site?

It can, if rolled out carelessly - a too-strict CSP can silently block your own scripts, analytics, or payment provider. See the CSP guide linked below for a safe rollout strategy using report-only mode before enforcing.

Free - no sign-up required

Check your security headers for free

CSP depth, HSTS preload verification, and CWE/OWASP mapping.

Run free audit