Free tool
Free HTTP security headers and TLS checker
Need the full scan and a report you can hand to a client?
This free check reads headers and TLS only. Passive OWASP ZAP, curated Nuclei checks and the 8-page PDF report need domain verification and open to early-access members first. Leave your email and we’ll tell you when you can verify this site.
✓ We'll email when you can run the full scan of this site, after you verify you control it.
Please confirm your address with the link we've just sent.
Enter any website you manage and get a graded report card for its HTTP security headers and TLS setup in a few seconds, with the specific fix for each gap. It is free, needs no account and is safe to run against production: it sends what a browser sends when someone opens the home page, and nothing else.
What the check sends and reads
- One HTTPS request for the home page, following up to three redirects (for example to
www.), on port 443 only. The response headers are read; the page body is not downloaded. - One plain-HTTP request for the home page on port 80, to see whether it redirects to HTTPS.
- Two TLS handshakes offering only TLS 1.0 and only TLS 1.1, to see whether the server still accepts them. No data is sent over them.
Requests identify themselves with the user agent ScanBastion-HeaderCheck/1.0 and a link to this page. The check never contacts private or reserved network addresses, never contacts other ports, and caches each result for ten minutes so repeat visits and shared links do not send the site the same requests again.
What is graded
| Check | Passes when | Points lost if missing or weak |
|---|---|---|
Strict-Transport-Security | Present with max-age of at least six months | 20 missing, 10 weak |
Content-Security-Policy | Enforced, and script-src has no wildcard, scheme-only source or bare 'unsafe-inline' | 25 missing, 15 report-only, 10 weak |
| Clickjacking protection | frame-ancestors in the CSP, or X-Frame-Options: DENY or SAMEORIGIN | 15 |
X-Content-Type-Options | nosniff | 10 |
Referrer-Policy | Set, and not unsafe-url or no-referrer-when-downgrade | 5 |
Permissions-Policy | Set | 5 |
| Cookie flags | Every cookie set on the home page has Secure and SameSite | 10 without Secure, 5 without SameSite |
| Version disclosure | Server and X-Powered-By carry no version numbers | 5 |
| HTTP to HTTPS redirect | http:// redirects to https:// | 10 |
| Certificate | Trusted, matches the hostname, more than 14 days from expiry | Untrusted: grade F. Expiring: 10 |
| TLS versions | TLS 1.2 or 1.3 negotiated; TLS 1.0 and 1.1 refused | 15 old protocol, 10 legacy accepted |
The score starts at 100. A+ needs 95 or more with nothing missing; A 85, B 70, C 55, D 40; below that, or without working HTTPS, the grade is F. Cross-Origin-Opener-Policy is shown for information and does not change the grade. X-XSS-Protection is not checked at all: no current browser uses it.
What this free check does not do
It looks at one page's headers and the TLS handshake. It does not crawl the site, look for vulnerable software, or test anything an attacker would send. A good grade means the browser-facing defences are configured; it does not mean the site is free of vulnerabilities. The guide what a website vulnerability scan does and doesn't cover explains the difference.
The full ScanBastion scan goes further and is why it requires DNS TXT domain verification first: a passive OWASP ZAP crawl of public pages, curated Nuclei checks for known vulnerabilities and exposures, a complete TLS analysis, and the results in an 8-page PDF report you can hand to a client. It opens to early-access members first.
Fixing what it finds
Each result comes with the fix. For copy-paste configuration, the HTTP security headers cheat sheet has a safe starting value for every header and ready-made blocks for nginx, Apache and Cloudflare, and the guide to configuring headers in Cloudflare, nginx and Vercel without breaking client sites covers the rollout. Run the check again after deploying to show the client a before and after.
Frequently asked
Can I check a site I don't own?
The check sends only what any visitor's browser sends, so it is no different from opening the site. Use it on sites you manage or are evaluating for a client; the full scan, which sends more, is limited to verified domains under our Responsible Scanning Policy.
Why does my CDN's grade differ from my origin server's?
The check sees what visitors see: the headers after every proxy and CDN on the way. If a header is set at the origin but stripped or overridden at the edge, the result reflects the edge. That is usually the setting to fix.
Can I share a result?
Yes. Every result has a link you can send to a client or colleague. The link preview shows the grade, and opening it runs the check again (or shows the cached result from the last ten minutes).
Do you store the results?
Results are kept in memory for ten minutes for caching and then discarded. The grade alone is kept for up to 24 hours so that a shared link can show it in a Slack, X or email preview. We log the hostname checked and the grade, as described in the Privacy Policy.