Skip to main content

HTTP security headers analyzer

Paste any HTTPS URL. We'll fetch it through an SSRF-safe client (no internal networks, no metadata endpoints), inspect the response headers, and grade the page on the standard security-headers checklist: CSP, HSTS, the X-headers, Referrer-Policy, Permissions-Policy, and the cross-origin isolation set.

HTTPS only. We refuse private/internal IPs. 5-second timeout.

Example result for example.com

Sample data. Run the check above to see yours.

Grade C

Review

https://example.com sends 8 of the 9 headers checked, but not Content-Security-Policy, and its HSTS header is incomplete.

  • Missing Content-Security-Policy: Cross-site scripting (XSS) and code injection by restricting which sources may load scripts, styles, frames, and connections.
  • Strict-Transport-Security: Missing includeSubDomains directive.

Want ongoing monitoring?

This tool is a one-shot check. PhishFence watches your domain with automated hourly monitoring (daily on Free) for DMARC changes, new lookalike registrations, and spoofing attempts.

Start free monitoring