HTTP security header auditor
Scan your site's HSTS, Content-Security-Policy, X-Frame-Options and Referrer-Policy and get a security score with what each header prevents.
HTTP security header audit
Seven headers separate a site that resists XSS and clickjacking from one that merely looks safe because it has a padlock. Enter the domain and get a graded, field-by-field report.
Frequently asked
My site shows a padlock. Isn't that enough?
No. The padlock only means the connection is encrypted. It doesn't stop XSS, doesn't stop another site from embedding yours in an iframe and doesn't force the browser to never use HTTP.
What is Content-Security-Policy?
It is the list of origins your site may load script, style and images from. It is the most effective defence against third-party script injected into your page.
This is the pocket version
The tool above solves one calculation. What I do under contract is keep it running inside your system, on your data, with nobody typing anything.