Security Headers Analyzer
Check which security headers a URL sends, which are missing, and what is wrong with the ones present.
- Runs on our servers
- Free to use
- API available →
About this tool
Security headers are cheap, server-side protections against clickjacking, MIME sniffing, protocol downgrade and script injection. The analyzer fetches the URL with the APIVoid Security Headers API and reports each security header as present or missing with its value, the issues detected in it and links to the MDN documentation, plus the full header dump for reference.
Run it after every deployment and on third-party sites you integrate with. The HTTP Headers tool shows raw headers without analysis.
How to use it — quick steps
- 01
Enter the url
Type or paste the url in the field above, for example https://www.example.com/
- 02
Press "Analyse security headers"
Press "Analyse security headers" or Ctrl + Enter. The result appears below in a few seconds.
- 03
Read the result
It appears in the dark panel under the form in a few seconds. Every block has [copy] and other actions.
Key features of this tool
External lookups
The lookup runs from our infrastructure, so you see what the public internet sees without exposing your own IP address or network.
Fast and cached
Results come back in seconds; identical lookups are cached for a few minutes to keep the service fast and responsive for everyone.
Easy to reuse
Every result block can be copied with one click or downloaded as a text file, and tables can also be saved as CSV for your reports.
Frequently asked questions
Which header matters most?
Strict-Transport-Security and a real Content-Security-Policy give the biggest gains; X-Content-Type-Options and X-Frame-Options (or frame-ancestors in CSP) are trivial to add and close common attacks.
X-XSS-Protection is missing, is that bad?
No. The header is deprecated and modern browsers ignore it; a CSP replaces it.
My CSP is reported as weak
Typical reasons: unsafe-inline or unsafe-eval in script-src, wildcard sources, or missing base-uri/object-src directives. The issue list explains each finding.