HSTS · CSP · X-Frame-Options · Permissions-Policy · COOP
Scan your security headers. Get the exact fix.
Other scanners give you a grade. We detect your stack and hand you copy-paste config for nginx, Apache, IIS, Cloudflare, Vercel, Netlify, CloudFront, Express, Next.js and WordPress.
Recently scanned
1. Scan
We fetch your page server-side, follow redirects and read every response header and cookie.
2. Grade
A 0–100 score across HSTS, CSP, framing, referrer, permissions, cross-origin policies, cookies and leaks.
3. Fix
Stack-specific config you can paste in minutes, with plain-English explanations and gotchas.
What do we check?
Strict-Transport-Security
Forces browsers to only use HTTPS for your domain.
Content-Security-Policy
Controls which scripts, styles and frames a page may load.
X-Content-Type-Options
Stops browsers from guessing (sniffing) file types.
X-Frame-Options
Prevents your site being embedded in iframes (clickjacking).
Referrer-Policy
Limits how much of your URLs leak to other sites.
Permissions-Policy
Turns off browser features (camera, mic, geolocation) you don't use.
Cross-Origin-Opener-Policy
Isolates your window from pop-ups and openers on other sites.
Cross-Origin-Resource-Policy
Stops other sites from loading your resources.
Cross-Origin-Embedder-Policy
Requires embedded resources to opt in (enables cross-origin isolation).
Fixes for every stack
Mapped to the frameworks auditors ask about
PCI DSS 4.0 6.4.3 & 11.6.1
Payment page script management and change/tamper detection of HTTP headers.
NIST 800-171 / CMMC L2 SC.L2-3.13.x
Boundary protection (3.13.1) and protecting CUI in transit (3.13.8, 3.13.11).
OWASP ASVS V14.4
HTTP security headers verification requirements.
SOC 2 CC6
Logical access and transmission protections (CC6.1, CC6.7, CC6.8).