Security Headers Scanner
Scan any URL and get a graded report on its HTTP security headers, HSTS, Content-Security-Policy, X-Frame-Options, and friends. Each is one line of server config that shuts down an entire attack class.
How to use
- Enter the full URL to scan (https://example.com).
- Click Run to fetch the response headers.
- Work through the missing headers, each includes what it protects against.
Security headers are instructions a server sends with every response telling browsers to enforce protections client-side. They cost nothing to add and neutralize whole categories of attack, which makes a failing grade here the cheapest security improvement available anywhere in your stack.
The core set: Strict-Transport-Security (HSTS) tells browsers to refuse plain-HTTP connections to your domain, killing SSL-stripping downgrade attacks. Content-Security-Policy (CSP) whitelists where scripts and other resources may load from, the single most effective mitigation against cross-site scripting, and also the hardest to write well. X-Frame-Options (and CSP's frame-ancestors) prevents your site being embedded in an attacker's iframe for clickjacking. X-Content-Type-Options: nosniff stops browsers second-guessing MIME types. Referrer-Policy controls how much URL detail leaks to other sites, and Permissions-Policy switches off browser features (camera, geolocation) you never use.
A realistic path: nosniff, X-Frame-Options, and Referrer-Policy are one-liners with essentially no breakage risk, add them today. HSTS is safe once you are confident the whole domain is HTTPS-only (start with a short max-age). CSP deserves respect: start in Report-Only mode, watch what would break, then enforce. A too-strict CSP silently breaking your own checkout flow is a self-inflicted outage no header is worth.
This scanner grades against the same header set Velona's own middleware sets on every response, we hold ourselves to the checklist we grade you on.
Examples
Input: https://github.com
Output: Grade A, HSTS ✓ CSP ✓ X-Frame-Options ✓ nosniff ✓ Referrer-Policy ✓Input: https://old-corporate-site.example
Output: Grade D, HSTS missing, CSP missing, X-Frame-Options missing. Nosniff presentFrequently asked questions
Which security header should I add first?
The free wins: X-Content-Type-Options: nosniff, X-Frame-Options: DENY (or SAMEORIGIN), and Referrer-Policy: strict-origin-when-cross-origin, near-zero breakage risk. Then HSTS once you are certain everything is HTTPS. CSP last, starting in Report-Only mode.
Can Content-Security-Policy break my site?
Yes, it is the one header that can. A policy that omits a CDN or an inline script you forgot about will block them for every visitor. Deploy as Content-Security-Policy-Report-Only first, review reports, then enforce.
What does HSTS actually do?
It makes the browser remember (for max-age seconds) that your domain is HTTPS-only, automatically upgrading any http:// attempt before a request ever leaves the machine, defeating downgrade and SSL-stripping attacks on hostile networks.
Do security headers affect SEO?
Not directly as a ranking factor, but HTTPS is one, and a site that fails basic hardening is more likely to be compromised, and a hacked, spam-injected site loses rankings very directly.
Related tools
Velona is India's INR-native AI API gateway with 300+ models, UPI top-up from ₹10, no foreign card needed. These tools are free forever.