Security Headers Checker

How it works

Security response headers are one of the fastest ways to tell whether a live site is taking browser-side risk seriously. When you paste a public URL, we fetch it with SSRF protections that block private and metadata hosts, then grade common headers: Strict-Transport-Security, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, and a couple of cross-origin policies. Missing HSTS or CSP usually hurts the grade the most because those controls reduce HTTPS downgrade and XSS impact. Weak values - for example HSTS without max-age, or X-Content-Type-Options that is not nosniff - also show up as findings. The score is intentionally simple so founders can act in minutes: add the missing headers in your host, CDN, or framework middleware, then re-check. This checker only looks at the headers on the response we receive for that URL. It does not crawl your app, test authenticated routes, or validate that CSP actually blocks real attacks in a browser. Different paths can return different headers, and CDNs sometimes strip or rewrite them. Use the grade as a launch hygiene signal, then run a full AtRisk URL scan for severity counts across a wider surface. If you are shipping a vibe-coded app, headers are often the first gap because AI builders optimize for “it loads” before defense-in-depth.

This is a free teaser check - not a penetration test, vulnerability assessment, or compliance audit. AtRisk full scans go deeper across more detectors and unlock fix prompts on Starter.