Security headers scanner
Enter a web address. Our server fetches the page once and your browser grades its security headers, cookies and TLS setup, with a fix for every finding.
Our server requests the address you enter once and returns its headers and certificate details. Nothing is stored.
How the scan works
Our server requests the address once, the way a browser would, and follows up to five redirects. It checks only public websites on the standard ports and refuses private, local and reserved addresses, including ones reached through a redirect. It returns the response headers and the TLS details; your browser does the grading.
The grade covers Strict-Transport-Security, Content-Security-Policy, X-Content-Type-Options, protection against framing, Referrer-Policy, Permissions-Policy, Cross-Origin-Opener-Policy and the redirect from http to https. It also flags version numbers in headers, cookies without Secure, obsolete headers, old TLS versions and certificate problems.
How the grade is calculated
The checks are worth 100 points in total, with deductions for leaks, insecure cookies and certificate or TLS weaknesses. 85 points or more is an A; A+ also needs HSTS with includeSubDomains, a CSP without weaknesses and no warnings. Without HTTPS, or with a certificate that browsers reject, the grade is F. The breakdown under each result shows where every point came from.
Questions
What does your server do with the address I enter?
It requests the page once, reads the response headers and certificate, and sends them back to your browser. Nothing is stored, and the scanner identifies itself as AngelForceScanner in the User-Agent header.
Can I scan an internal or staging site?
Only if it is reachable from the internet on the standard ports. The scanner refuses private, local and reserved addresses so that it cannot be used to probe internal networks.
Why is the number of scans limited?
Each scan makes real requests to the target site, so we allow six scans every ten minutes per connection to keep the service fair and to prevent abuse.
Why does another scanner give a different grade?
Each scanner weighs headers differently. The findings and the score breakdown show exactly what we checked, which matters more than the letter.
Need more than a tool can show?
A tool checks one thing. Our consultants look at the whole picture.
Penetration testingRelated articles
-
A practical WordPress security checklist
Twelve WordPress hardening steps in a sensible order, from updates and abandoned plugins to 2FA, XML-RPC, backups, file integrity and a WAF.
-
Security headers that matter, and the ones to retire
A practical guide to CSP with nonces, HSTS and preload, frame-ancestors, Referrer-Policy, Permissions-Policy and COOP, with examples and what to drop.
-
How to design and test secure file uploads
A checklist of controls for file upload features, based on the OWASP cheat sheet, with a table of tests to run against each upload endpoint.