Headers analyzed, not just listed
CSP directive depth, live HSTS preload verification, and a CWE/OWASP reference for every finding - the deepest single check Scanverra runs.
Check my headers freeThe core headers, at a glance
| Header | What it does | CWE |
|---|---|---|
| Content-Security-Policy | Restricts which scripts, styles, and resources can load | CWE-693 |
| Strict-Transport-Security | Forces HTTPS, blocking protocol-downgrade attacks | CWE-319 |
| X-Frame-Options | Prevents your site being framed for clickjacking | CWE-1021 |
| X-Content-Type-Options | Stops browsers from MIME-sniffing responses | - |
| Referrer-Policy | Controls what's sent in the Referer header to other sites | - |
| Permissions-Policy | Restricts access to browser features like camera and geolocation | - |
What "analyzed" actually means here
CSP directive analysis
Not just "is a CSP present" - checks base-uri, form-action, object-src, and frame-ancestors individually, and flags overly broad wildcard sources.
Live HSTS preload verification
Checks your HSTS max-age and includeSubDomains settings, then makes a live call to the Chrome HSTS preload list API to confirm whether your domain is actually preloaded, not just configured to request it.
Deprecated header detection
Flags headers like X-XSS-Protection that browsers have deprecated and no longer honor, so you're not relying on protection that no longer exists.
How it works
One scan, every header, real analysis.
Paste your URL
An external check against your live response headers - the same headers any visitor's browser receives.
Every header analyzed
Presence, configuration depth, and known weaknesses - not a simple present/missing checklist.
Fixes with exact header values
Each finding comes with a CWE identifier, an OWASP Top 10 category, and a specific recommended header value to set.
Frequently asked questions
Isn't checking security headers something any tool can do?
Listing which headers are present is easy. Analyzing whether a Content-Security-Policy is actually restrictive, whether your HSTS header is genuinely preloaded (not just configured), and mapping each gap to a specific CWE and OWASP category is the part most header checkers skip.
What does "CWE" and "OWASP" mean on my report?
CWE (Common Weakness Enumeration) is a standard identifier for a class of security weakness; OWASP Top 10 is a widely-referenced list of the most critical web application security risks. Mapping findings to both makes them easier to communicate to a security team or auditor who already works in that vocabulary.
Can this tool tell me if I'm on the HSTS preload list?
Yes - it makes a live check against the Chrome HSTS preload list API, so you get a real answer, not just whether your header includes the word "preload."
Will adding a strict CSP break my site?
It can, if rolled out carelessly - a too-strict CSP can silently block your own scripts, analytics, or payment provider. See the CSP guide linked below for a safe rollout strategy using report-only mode before enforcing.
Related audits
Website Audit
Run a free instant audit for performance, SEO, accessibility, and best practices.
SEO Audit
Check crawlability, metadata, structured data, and AI-agent discoverability.
Performance Audit
A full Lighthouse lab run across desktop and mobile, with framework-aware fixes.
Accessibility Audit
See exactly which WCAG 2.1/2.2 success criteria your site fails, and why.
Security Audit
Turn a header/vulnerability scan into SOC 2 and GDPR control evidence.
Website Speed Test
How fast your site loads, in plain language - one number, no jargon.
Core Web Vitals Test
Check LCP, CLS, and INP against Google's thresholds, lab and field.
Broken Link Checker
Crawl a page's links and find the ones that are dead before your users do.
Open Graph Checker
See whether your page has the og:title, og:description, and og:image tags social platforms need.
Schema Markup Checker
Check whether your page ships JSON-LD structured data search engines and AI agents can read.
Sitemap Checker
Check whether your sitemap.xml is reachable, valid, and free of common mistakes.
Redirect Checker
Trace a URL's redirect chain and catch loops, excess hops, and HTTPS-to-HTTP downgrades.
Related reading
Website Security Headers Explained: The Complete Checklist
CSP, HSTS, X-Frame-Options, and every other HTTP security header your site should ship - with copy-pasteable examples.
How to Implement a Content Security Policy Without Breaking Your Site
CSP is the highest-leverage security header and the easiest one to break your own site with - a safe rollout strategy using report-only mode.
Check your security headers for free
CSP depth, HSTS preload verification, and CWE/OWASP mapping.
Run free audit