How to audit a site's HTTP security headers

1. Enter the page URL

   Put the https:// page into the "Page URL" field. The scheme is auto-added if missing. Up to 2048 characters.

2. How the probe works

   Our server tries HEAD first, then falls back to GET if the origin replies 405/501. It follows redirects, drains the body, and analyses the response headers — your browser never makes this request.

3. Press Run

   Result returns finalUrl (after redirects), httpStatus, scorePercent (presentCount/totalChecks), and rows[] — one row per checked header with its name, status, and the value if present.

4. Interpret the score

   It's a count of expected security headers present (CSP, HSTS, X-Frame-Options, Referrer-Policy, etc.), not a full audit. A high score does not certify the site is secure — review each row's value to confirm policy strength.