Skip to content
Check a domain

Security headers checker · from $8

Runs in every scan · 8 checks

Check your website's security headers — and what each one means.

HSTS, CSP, X-Content-Type-Options, Referrer-Policy and cookie flags, read from your live homepage, exact values included.

Quick Scan

Areas checked
11
In good shape
2
Fixes in minutes
4 of 6
  1. Medium

    Keep the login cookie on HTTPS

    F2 · Confirmed · Minutes

    Evidence

    Observed
    Set-Cookie: PHPSESSID=…; path=/
    Expected
    Set-Cookie: PHPSESSID=…; path=/; Secure; HttpOnly; SameSite=Lax

    Fix

    1. Add the Secure and HttpOnly flags (and SameSite=Lax) to session cookies.
    2. In PHP: session.cookie_secure = 1 and session.cookie_httponly = 1.
  2. Low

    Add a DMARC record for your domain

    F3 · Confirmed · Minutes

    Evidence

    Observed
    _dmarc.example.com TXT (no record)
    Expected
    _dmarc.example.com TXT "v=DMARC1; p=none; rua=mailto:dmarc@example.com"

    Fix

    1. Publish a _dmarc TXT record.
    2. Start with v=DMARC1; p=none; rua=mailto:dmarc@your-domain to monitor, then move to p=quarantine.
  3. Medium

    Update an outdated component

    F1 · Likely · Hours

+ 5 more findings in the full report Open the sample report

What you get

A report you can act on.In plain English, with evidence.

Security headers tell browsers how to protect your visitors. ScanDefend reads the ones your homepage sends (and the ones it doesn't), explains each, and gives you the line to add.

  • Strict-Transport-Security, Content-Security-Policy, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy
  • Cookie flags: Secure, HttpOnly, SameSite
  • HTTP → HTTPS redirects
  • The exact header value on every finding

What we check

Every header we read.And how well it's set.

Part of every Quick Scan, alongside the other checks.

A sensible starting set of headers
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy-Report-Only: default-src 'self'
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
Referrer-Policy: strict-origin-when-cross-origin
Permissions-Policy: camera=(), microphone=(), geolocation=()

  • Strict-Transport-Security (HSTS)

    Browsers told to always use HTTPS, for long enough.

  • Content-Security-Policy

    Present, enforced, and how tightly it limits scripts.

  • X-Content-Type-Options

    Browsers don't guess file types.

  • Framing protection

    X-Frame-Options or frame-ancestors keeps your pages out of other sites' frames.

  • Referrer-Policy and Permissions-Policy

    What you share with other sites, and which browser features you switch off.

  • Scripts from other sites

    Integrity checks (SRI) on scripts loaded from elsewhere.

  • Cross-site sharing (CORS)

    Set up so other sites can't read signed-in data.

  • Cookie flags

    Secure, HttpOnly and SameSite on the cookies your homepage sets.

Real format

Two findings.Exactly as a report shows them.

Open the full sample report

F4 · security-headers

Tell browsers to always use HTTPS

Low Confirmed Minutes

What it means
An HSTS header sends browsers straight to https://, even when a visitor types your address without it, so after the first visit, every return visit goes straight to an encrypted connection. Adding your site to the HSTS preload list covers the very first visit too.
Evidence
Strict-Transport-Security: (header absent)
Expected
Strict-Transport-Security: max-age=31536000; includeSubDomains
Fix
Send Strict-Transport-Security: max-age=31536000; includeSubDomains once every subdomain works over HTTPS.

F5 · security-headers

Add a Content Security Policy

Low Confirmed Days

What it means
A Content Security Policy tells browsers which scripts your pages may load. A restrictive, well-configured CSP can limit what injected script loads or where it sends data.
Evidence
Content-Security-Policy: (header absent)
Fix
Start with Content-Security-Policy-Report-Only to learn what the site legitimately loads, then enforce the policy.

Pricing

From $8 a check.Buy more, pay less per check.

Plus applicable tax, shown before you pay. No subscription.

See pricing and the calculator

Quick Scan

Available

5 checks cover a month of weekly checks for $18. No subscription.

  • One credit checks one website
  • Credits last 12 months
  • No subscription, no auto-renewal
  • Credit back automatically if your scan can't run or half or fewer of its checks run. If your website blocks us but most checks ran, the website checks re-run free, once, within 30 days. How credits work

Your first check is free — on a website you've verified you own.

Check my headers

Checkout by Stripe. We never see your card.

Prices before tax. Final total shown before you pay.

Powered by Stripe

Apple Pay Google Pay · Link · Visa · Mastercard · American Express

Where available for your device and country.

Questions

Short answers.

Something else? support@scandefend.com

Which headers does ScanDefend check?

Strict-Transport-Security (HSTS), Content-Security-Policy, X-Content-Type-Options, X-Frame-Options, Referrer-Policy and Permissions-Policy, plus the Secure, HttpOnly and SameSite flags on cookies set by the homepage.

Which page does it check?

Your homepage. Headers are often set site-wide at the server or CDN, but other pages can differ, and the report says so in its scope.

Can I export the results?

Yes. A free account keeps the full report with PDF, JSON and Markdown downloads, and your scan history for re-checks after changes.

Keep exploring

Also useful: What we check Sample report Pricing For developers Let ScanDefend in

See what your website shows.Know what to fix first.

See pricing