Check your site for Content-Security-Policy, HSTS, X-Content-Type-Options, frame protections, Referrer-Policy, and Permissions-Policy — with the exact header value to add for every miss.
Launch day concentrates traffic, scrutiny, and (unfortunately) opportunistic attackers onto a site you built in a few weeks. Security headers are the fastest layer of defense you can add before that happens: a handful of HTTP response headers that tell browsers to enforce sane defaults. This scanner fetches your URL, reads the response headers, and grades each one so you know exactly what to add before you submit to directories and start collecting clicks.
max-age seconds. With a one-year max-age plus includeSubDomains, an attacker on coffee-shop Wi-Fi cannot downgrade the connection.strict-origin-when-cross-origin is the modern default worth making explicit.If your site is a Next.js app, define headers centrally in next.config.js (or next.config.mjs) using the headers() function:
// next.config.js
module.exports = {
async headers() {
return [
{
source: '/:path*',
headers: [
{
key: 'Content-Security-Policy',
value:
"default-src 'self'; script-src 'self'; object-src 'none'",
},
{
key: 'Strict-Transport-Security',
value: 'max-age=31536000; includeSubDomains; preload',
},
{ key: 'X-Content-Type-Options', value: 'nosniff' },
{ key: 'X-Frame-Options', value: 'DENY' },
{
key: 'Referrer-Policy',
value: 'strict-origin-when-cross-origin',
},
{
key: 'Permissions-Policy',
value: 'camera=(), microphone=(), geolocation=()',
},
],
},
]
},
}If you use the App Router with middleware, the same headers can be set in middleware.ts — useful when a policy needs per-page nonce values. Deploy afterwards, re-run this scanner, and confirm every check flips to pass.
On Vercel, the next.config approach works as-is; for static exports or other hosts, use a _headers file or platform config. On Netlify, place this in public/_headers:
/* Content-Security-Policy: default-src 'self'; object-src 'none' Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Content-Type-Options: nosniff X-Frame-Options: DENY Referrer-Policy: strict-origin-when-cross-origin Permissions-Policy: camera=(), microphone=(), geolocation=()
Cloudflare Pages uses the same _headers format. GitHub Pages cannot set custom headers, so front it with Cloudflare or move hosting if headers matter to you. On nginx, add a add_header block per header in your server configuration; on Apache, use Header always set with mod_headers.
A green grade here is a good preflight signal, not a certificate of security. Headers harden the browser's behavior around your site; they do nothing about SQL injection in an API route, weak password storage, leaked environment variables, or an insecure dependency in package.json. Treat the scan as one layer in a stack: write input validation and auth checks in code, keep dependencies patched, use HTTPS everywhere, and then let headers mop up the classes of attack that live in the browser. The scanner's grade reflects one response at one point in time — re-run it after deployments that change hosting, CDN, or middleware.
Why did my site get a B instead of an A?
The most common gap is a missing or permissive Content-Security-Policy, or HSTS with a short max-age. Each warn costs points, so two loose headers can drop a B-level score. Follow the fix line on every non-pass check and rescan.
Is unsafe-inline in my CSP really a problem?
Yes for script-src: allowing inline scripts means any injected HTML runs as code, which is exactly what XSS attackers need. Move inline scripts into files, or use nonces/hashes if a framework requires inline bootstrap code.
My site redirected — which response did you grade?
We grade the headers of the final response after following redirects, because that is what browsers actually receive. The redirect chain is shown above the checks so you can confirm http→https redirects are working.
Does this scan prove my site is secure?
No. It verifies that a specific set of security headers is present and reasonably configured on one URL. It cannot see your application code, database, dependencies, or TLS settings, so a high grade is a preflight checklist item — not an audit.
How often should I rescan?
After any change to hosting, CDN configuration, middleware, or framework version, and again before each major launch or campaign. Headers can silently disappear when a new proxy or deployment pipeline is introduced.
Run the header scan before your launch day, then track directory submissions alongside the fixes from the same dashboard.