HeaderScan HTTP Security & Performance Header Analyzer
Analyze HTTP response headers for any web URL. Inspect security policies, cache directives, server configurations, and CSP.
Defense-in-Depth HTTP Security Architecture
Security headers instruct modern browsers to enforce strict behavioral sandboxes, cutting off major exploitation vectors at the protocol layer.
Transport & Encryption
HSTS forces encrypted TLS connections and prevents SSL stripping attacks, securing data in transit across all subdomains.
Execution Sandboxing
CSP and X-Content-Type-Options prevent unauthorized code execution, neutralizing Cross-Site Scripting (XSS) and MIME confusion.
Framing & Leak Prevention
X-Frame-Options, Referrer-Policy, and Permissions-Policy block clickjacking and prevent accidental token leakage.
Security Score & Grade Bands
Scores are computed from OWASP-recommended HTTP header checks and security configurations.
Outstanding defense posture. Complete security policies configured without unsafe directives.
Robust protection. Core security headers present with minor configuration recommendations.
Partial coverage. Critical headers like CSP or HSTS are missing or weakly configured.
Vulnerable posture. Lacks basic browser-enforced security headers and protections.
Key HTTP Headers Reference Guide
Content-Security-Policy
CSPRestricts the sources from which scripts, styles, images, and frames can be loaded.
Why it matters: Blocks Cross-Site Scripting (XSS), data injection, and malicious external script execution.
Strict-Transport-Security
HSTSForces browsers to communicate exclusively over HTTPS for all present and future requests.
Why it matters: Eliminates man-in-the-middle SSL stripping and protocol downgrade attacks.
X-Content-Type-Options
XCTOPrevents the browser from MIME-sniffing a response away from the declared content-type.
Why it matters: Stops malicious executable files disguised as benign images or text from executing.
X-Frame-Options
XFOControls whether the page can be rendered inside a <frame>, <iframe>, <embed> or <object>.
Why it matters: Protects users against clickjacking attacks by forbidding illegitimate foreign iframe embedding.
Referrer-Policy
ReferrerControls how much referrer information is sent along with navigation and subresource requests.
Why it matters: Prevents sensitive query parameters, user tokens, and internal paths from leaking to third parties.
Permissions-Policy
PermissionsExplicitly grants or denies browser hardware and API permissions (camera, microphone, geolocation).
Why it matters: Hardens user privacy by restricting unauthorized feature usage in embedded frames and third-party scripts.
Cache-Control
CacheInstructs browser and edge CDN caches how long responses may be cached and when to revalidate.
Why it matters: Accelerates load times while ensuring dynamic or sensitive endpoints are not cached publicly.
Server & Framework Masking
ServerRemoves or masks server banners (e.g. nginx/1.18.0, Express, Apache, PHP version).
Why it matters: Denies attackers automated fingerprinting and version-specific vulnerability targeting.
Frequently Asked Questions
What are HTTP security response headers and why are they vital?
+
HTTP security headers are directives sent by the web server in response to browser requests. They configure built-in browser security mechanisms to prevent critical vulnerabilities like Cross-Site Scripting (XSS), clickjacking, MIME-type confusion, and protocol downgrade attacks.
What does a failing grade or low security score mean?
+
A low score indicates that your server is not transmitting key defense-in-depth headers (like Content-Security-Policy or Strict-Transport-Security). While your website may still function normally, it is relying solely on application-level defenses without the browser-level containment policies recommended by OWASP.
How does Content-Security-Policy (CSP) protect my users?
+
CSP specifies trusted sources for executable scripts and media. Even if an attacker discovers a code injection flaw on your website, a strong CSP prevents the browser from executing foreign or untrusted inline scripts, neutralizing most XSS vectors.
Why should I hide or mask the Server header?
+
Exposing exact web server and framework version numbers (like Apache/2.4.41 or PHP/7.4) lets automated scanners quickly identify unpatched CVEs on your host. Masking or removing this header prevents easy automated reconnaissance.