Ambiakshi ToolsNetwork Check — contacts target hostSecurityOWASPDevOpsScan a site's security headers
Score CSP, HSTS, X-Frame-Options, and Permissions-Policy from A+ to F.
This tool sends your input (e.g. domain or URL) to retrieve live headers or DNS records. We do not store the response or track your target. How this works →
HTTP security headers diagnostic
Security header scans reflect HTTP response headers received by our diagnostic client at the time of testing. Header presence is a vital component of defense-in-depth, but does not guarantee the absence of application-level vulnerabilities or server misconfigurations.
Standard: Scores 6 core modern security headers (CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy) from A+ to F.
Frequently asked
Direct answers for search, answer engines, and generative crawlers.
HTTP security headers are response directives sent by web servers to instruct browsers how to handle content, permissions, and framing. Properly configured headers protect websites against Clickjacking, Cross-Site Scripting (XSS), MIME-type sniffing, and man-in-the-middle attacks.
Feedback, bugs & custom requests
Found a bug, a math anomaly, or a missing feature on Scan a site's security headers? Send it to engineering — reports land in our Discord channel. Optional email if you want a follow-up.
Related tools
Canonical: /developer/security-headers. Estimates and conversions are educational. See the full disclaimer.