Score CSP, HSTS, XFO, and related HTTP security headers on a live URL.
- Free
- No signup
- Fast
- Privacy-friendly
What next?
Keep going with Security Headers Analyzer
Finish this check in the browser, then pick the path that matches how you work — another related tool, REST for apps, or MCP for agents.
- 1. Related check
After this result, run CSP policy evaluator for the next signal.
CSP policy evaluator - 2. Automate with API
Same job from your server with
Create free accountX-Api-Key. Free tier includes 500 credits/month. - 3. Hand off to an agent
Connect MCP and run playbook ship-gate, then verify until pass.
ship gate
What is Security Headers Analyzer?
Fetch a public URL and score security response headers (CSP, HSTS, X-Frame-Options, and related). Author CSP text with the CSP Policy Evaluator, then verify live with this tool. Agents include this check in ship-gate and web-security-audit playbooks, then verify until the gate passes — see <a href="/developers/ship-gate">ship gate</a> and <a href="/developers/security-audit">security audit</a>. REST/MCP on one credit quota.
What are common questions about Security Headers Analyzer?
What does Security Headers Analyzer do?
Score CSP, HSTS, XFO, and related HTTP security headers on a live URL.
Is this available via API and MCP?
Yes. Same route under /api/v1/security-apis/{slug} with one ToolYour API key.
What are the key features of Security Headers Analyzer?
Merged header checklist
One page for CSP/HSTS/frame/MIME/referrer/permissions/COOP instead of thin single-header tools.
Score and grade
Weighted score from pass/warn/fail so agents and dashboards can sort results.
API and MCP
GET with url query or POST with body.url — same credit-backed path agents use.
How do you use Security Headers Analyzer?
Paste a public HTTPS URL
Use the live page you care about (homepage, login, or app shell).
Run the analyzer
Complete the bot check; we fetch headers and score each control.
Fix fails first
Prioritize missing CSP and HSTS, then frame and MIME sniffing controls.
When teams use security headers checks
Pre-launch hardening, vendor reviews, and CI smoke checks after CDN or reverse-proxy changes. Pair with TLS certificate and cookie flag tools in this category.
Free · API · MCPToolYour platform
Use Security Headers Analyzer three ways
The free Security Headers Analyzer on this page works in your browser. The same workflow is available via REST API for apps and via the remote MCP server for Cursor, Claude, and other agents — one API key, one plan, one quota. This tool is part of the security-apis module under Security Tools.
Agents close the full job with run_playbook ship-gate, then verify until pass — see ship gate.
- 1Create a free accountGet an API key for REST and MCP — 500 credits/month on the free tier.
- 2Connect or callPaste the MCP URL into Cursor/Claude, or call REST with
X-Api-Key. - 3Same key & creditsBrowser smoke-checks stay free; API-backed runs share one monthly credit quota.
- Free in browserUse Security Headers Analyzer here — no account required.
- REST APICall from your server with
X-Api-Key. - Remote MCP serverSame job from Cursor or Claude via the ToolYour remote MCP server — one API key with REST.
Which web-hardening tools sit in this cluster?
- CSP policy evaluator
Author and sanity-check CSP text offline.
- Cookie security analyzer
Secure, HttpOnly, and SameSite flags.
- CORS policy checker
ACAO wildcards and Origin reflection.
- Subresource integrity checker
Missing integrity= on third-party assets.
- security.txt checker
RFC 9116 disclosure file presence.
Where does this job fit on ToolYour?
Which SEO or privacy tools pair with this security check?
Where do you browse more security tools tools?
- Security Tools tools
Browse the full Security Tools category on ToolYour.
- Developer Tools tools
Format JSON, encode Base64/URL, mint UUIDs, convert timestamps, and test regex in the browser. REST and MCP sh
- Marketing Tools tools
Build UTM links, check ads copy limits, QA email subjects, and calculate ROAS/CPC/CTR — free in the browser; R
Which toolkits include Security Headers Analyzer?
- Security Toolkit
HTTP security headers, TLS, cookies, CORS, redirects, DNS, secrets, JWT, passwords, hashes, HMAC, bcrypt, security.txt, SRI, and email auth — plus agent playbooks for full audits and ship gates.
- Developer Toolkit
JSON/XML/SQL formatters, encoders, UUID/timestamp/regex, JSON codegen, JWT minting, HTTP headers, request builders, cron, minifiers, and color conversion — plus security and text peers.