HTTP Security Headers Analyzer fetches your site over HTTPS, captures every response header, and grades it against the modern best-practice baseline — HSTS, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, Cross-Origin-Opener-Policy, Cross-Origin-Embedder-Policy, Cross-Origin-Resource-Policy, and more. Reports an overall security grade (A+ to F) plus the specific missing or weak headers that knock the grade down.
Twelve security headers, graded against modern best-practice values — not just 'present or absent' but 'configured correctly'. The grade is composite; the per-header breakdown tells you exactly what to fix.
Tells browsers to always connect over HTTPS. Graded on max-age (≥ 31536000), `includeSubDomains`, and `preload` (the strictest configuration enrolls the domain in the HSTS preload list, baked into Chrome, Firefox, and Safari shipping).
Whitelists which sources scripts, styles, frames, and other resources may load from. The strongest single defense against XSS. Graded on `default-src` strictness, presence of `'unsafe-inline'` / `'unsafe-eval'` (both significantly weaken protection), nonce/hash usage, and `frame-ancestors`.
Prevents your site from being embedded in iframes on other origins (UI redress / clickjacking attacks). `DENY` or `SAMEORIGIN` accepted. Modern best practice: replace with CSP `frame-ancestors` which is more granular.
`nosniff` prevents browsers from second-guessing the declared content-type. Without it, a file labeled `text/plain` containing HTML could be executed as a script under some conditions. Cheap to set; should always be present.
Controls how much Referer information is sent to third-party origins. Best practice: `strict-origin-when-cross-origin` or `no-referrer`. Mitigates leak of sensitive path/query data in outbound requests.
Restricts which browser features (geolocation, camera, microphone, payment, USB, etc) can be used by your origin and embedded iframes. Hardening reduces attack surface from compromised third-party scripts.
`same-origin` enables cross-origin isolation, which unlocks high-resolution timers and shared memory and gives stronger protection against Spectre-class attacks. Increasingly important for security-sensitive sites.
Pairs with COOP. `require-corp` means cross-origin resources must opt in via CORP or CORS. The combination of COOP + COEP is what enables `crossOriginIsolated` in modern browsers.
Most security headers are one-line config changes that immediately raise the cost of common attacks. Five reasons they're underrated:
A header check is one HTTPS request plus a structured grade. We follow the same logic Mozilla's Observatory, securityheaders.com, and similar tools use — with explicit explanations of why each header earns the grade it does.
CSP is the most powerful security header — and the hardest to configure. Done well, it eliminates XSS. Done poorly, it provides false security or breaks the site. Five things to know:
Every header, per-header grade, and recommendation is available as JSON. Useful for CI gates that prevent regressing security headers, vendor due diligence, and continuous header-monitoring across a portfolio of sites.
curl 'https://api.domainscan.in/v1/security/headers?url=https://github.com'const res = await fetch(
'https://api.domainscan.in/v1/security/headers?url=https://github.com'
);
const hdr = await res.json();
console.log(hdr.grade); // 'A'
console.log(hdr.score); // 91
// Per-header detail
hdr.headers.forEach(h => {
console.log(`${h.name}: ${h.score}/100 — ${h.status}`);
});
// CI gate: fail build if grade regresses
if (['F', 'E', 'D'].includes(hdr.grade)) {
console.error('Security headers grade regressed:', hdr.grade);
process.exit(1);
}
// Fix list
hdr.recommendations.forEach(r => {
console.log(`[${r.severity}] ${r.header}: ${r.action}`);
});{
"url": "https://github.com",
"grade": "A",
"score": 91,
"headers": [
{
"name": "Strict-Transport-Security",
"value": "max-age=31536000; includeSubDomains; preload",
"score": 100,
"status": "strong",
"notes": "max-age=1y, preload-eligible"
},
{
"name": "Content-Security-Policy",
"value": "default-src 'none'; script-src ...",
"score": 85,
"status": "good",
"notes": "Strict default-src, no 'unsafe-inline'"
}
],
"recommendations": [
{
"severity": "medium",
"header": "Permissions-Policy",
"action": "Add Permissions-Policy header restricting unused browser features"
}
]
}Six patterns we see most often:
Wire the API into your CI/CD pipeline. Block deploys that regress the security-headers grade. Catches the well-intentioned middleware change that accidentally removed HSTS three releases ago.
PCI-DSS, SOC 2, ISO 27001, HIPAA audits all reference HTTP security headers. A documented A or A+ grade satisfies the relevant controls without manual evidence-gathering.
Evaluating a SaaS that will handle your customer data. Their security-headers grade is a leading indicator of broader security maturity. F-grade sites correlate with deeper issues.
Before paying for an external pen test, run security-headers and other low-hanging-fruit checks. Fix the obvious findings yourself; let the pen-testers spend their hours on harder issues.
Run the checker against every public site of a target acquisition. The header grades tell you how much post-acquisition hardening work to expect.
Cron the API against your portfolio of sites. Alert on grade regressions. Catches the silent drift when a new CDN config or middleware change accidentally removes a critical header.