Check whether a website sends the HTTP security headers that protect users from XSS, clickjacking, and protocol downgrade attacks.
Was this tool helpful?
91% · 97 people found this tool helpful
HTTP security headers are the cheapest, highest-leverage defence a website has: a single response header can block clickjacking, force HTTPS for a year, or shut down an entire class of XSS attacks. This scanner fetches any URL, reads the headers your server returns, and grades the result A–F against the modern baseline — HSTS, CSP, X-Frame-Options, COOP, COEP, CORP, Referrer-Policy and Permissions-Policy.
Type or paste the target you want to inspect into the input field at the top of the page.
Click the check button — the tool queries live data sources and returns results in seconds.
Review each finding: status, score, and the reason behind every warning are listed line by line.
Follow the linked remediation guides to fix issues, or copy the report to share with your team.
When something in your stack misbehaves, half the battle is figuring out whether the problem is you, the network, or the other side. Security Headers Scanner gives you a fast, opinionated readout so you can rule things in and out in seconds. Because the check runs on live infrastructure and reports raw results — not marketing-safe summaries — you can trust what you see and act on it. Toolzer's design philosophy is simple: privacy-first (no tracking, no accounts), performance-first (the page is interactive in under a second on a 3G connection), and honesty-first (no fake ratings, no dark patterns, no upsells). Security Headers Scanner follows the same rules as every other utility on the site. You can bookmark this page, share the URL with a colleague, or pin it to your browser's toolbar — the experience will be identical every visit, and it will keep working even if you're on airplane Wi-Fi. Real people use this tool for real work — freelancers cleaning up client deliverables, sysadmins triaging tickets, students finishing assignments — and it is tuned for those workflows, not for demo videos.
Any production site should reach at least B. Aiming for A requires a real Content-Security-Policy, which takes deliberate engineering — but it's the single most effective XSS mitigation available.
Yes, on legacy sites. Start in Content-Security-Policy-Report-Only mode, monitor violations, then promote to enforcing once your inline scripts and third parties are inventoried.
It's deprecated and removed from modern browsers. CSP replaces it. Keep your headers tight, not long.
Yes. We grade the final response, so a domain that redirects HTTP → HTTPS is scored on the HTTPS response, which is what matters to users.
No. Every utility on Toolzer is free, anonymous, and works in any modern browser without registration.
Yes. Whenever the tool can produce an answer entirely in the browser, the data never leaves your device.
Yes. The interface is fully responsive and works on iOS Safari, Android Chrome, and every modern mobile browser.
Yes. Every Toolzer page has a clean permanent URL you can bookmark or share.
HTTP response headers carry the metadata that controls caching, security, content type, redirects and CDN b…
An SSL/TLS certificate proves that the site you connect to really is the one in the address bar and that th…
Phishing pages rarely use obviously fake URLs — they hide behind punycode lookalikes, brand names inside lo…
Shortened URLs (bit.ly, t.co, lnkd.in) and tracking links can hide their final destination behind half a do…
Cookies aren't the only way sites track you.
If you lose your phone or hardware token, 2FA backup codes are the only way back into your accounts.