Scans any domain using the MDN HTTP Observatory. Returns a grade (A+ to F), score, and link to the full test breakdown.
Inspects HTTP security headers via Mozilla Observatory. Enter a domain or URL. First-time scans may take a few seconds while Observatory fetches and analyses the site.
Fetches HTTP response headers from any URL and evaluates the security-relevant ones: Content-Security-Policy, Strict-Transport-Security, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy.
Each header is rated against current best-practice expectations. Missing headers are flagged, weak configurations are called out, and well-configured headers are confirmed. The check is read-only — it only inspects what the server sends back.
HTTP security headers are one of the most commonly flagged issues in web application security assessments because they are easy to check, easy to fix, and frequently overlooked. HSTS prevents SSL stripping. CSP reduces XSS blast radius. X-Frame-Options blocks clickjacking.
Headers that are missing or misconfigured rarely cause immediate breaches on their own, but they eliminate layers of defense that make other vulnerabilities harder to exploit. Auditing them takes seconds. Fixing them is usually a one-line server config change.