Score CSP, HSTS, X-Frame-Options, and related HTTP security headers on a live URL with pass/warn/fail advice.
- Free
- No signup
- Fast
- Privacy-friendly
Free · API · MCPToolYour platform
Use Security Headers Analyzer three ways
The free Security Headers Analyzer on this page works in your browser. The same workflow is available via REST API for apps and via MCP for Cursor, Claude, and other agents — one API key, one plan, one quota. This tool is part of the security-apis module under Security Tools.
- Free in browserUse Security Headers Analyzer here — no account required.
- REST APICall from your server with
X-Api-Key. - MCP for agentsConnect Cursor or Claude to ToolYour MCP with the same key.
- 1. Get an API keySign in and open Dashboard → API Keys (works for REST and MCP).
- 2. Call or connectUse the REST API from your server, or paste the MCP URL into your agent config.
- 3. Same qualityOutput matches the free web tool across all three surfaces.
What is Security Headers Analyzer?
You need a quick read on whether a site sends the headers that reduce XSS, clickjacking, and protocol downgrade risk. ToolYour Security Headers Analyzer fetches a public URL and scores Content-Security-Policy, Strict-Transport-Security, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, and Cross-Origin-Opener-Policy. Missing or weak values show as fail/warn with short fix advice. This is a response-header check on one URL — not a full penetration test. Same route via REST and MCP (/api/v1/security-apis/security-headers-analyzer). For http:// assets on HTTPS pages, use Mixed Content Checker under digital tools.
What are common questions about Security Headers Analyzer?
Which headers does the analyzer check?
CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, and Cross-Origin-Opener-Policy. Each row shows present/absent, severity, and advice.
Does a high score mean the site is secure?
No. Strong headers help, but auth bugs, vulnerable libraries, and misconfigured backends are out of scope. Use this as a hardening checklist, not a green light.
How do I call this via API?
GET /api/v1/security-apis/security-headers-analyzer?url=https://example.com with X-Api-Key, or POST with { "url": "..." }.
What are the key features of Security Headers Analyzer?
Merged header checklist
One page for CSP/HSTS/frame/MIME/referrer/permissions/COOP instead of thin single-header tools.
Score and grade
Weighted score from pass/warn/fail so agents and dashboards can sort results.
API and MCP
GET with url query or POST with body.url — same credit-backed path agents use.
How do you use Security Headers Analyzer?
Paste a public HTTPS URL
Use the live page you care about (homepage, login, or app shell).
Run the analyzer
Complete the bot check; we fetch headers and score each control.
Fix fails first
Prioritize missing CSP and HSTS, then frame and MIME sniffing controls.
When teams use security headers checks
Pre-launch hardening, vendor reviews, and CI smoke checks after CDN or reverse-proxy changes. Pair with TLS certificate and cookie flag tools in this category.
Where do you browse more security tools tools?
- Security Tools tools
Browse the full Security Tools category on ToolYour.
- AI Tools tools
PII scrub, resume match, transcription, video summarize, and YouTube analysis. Free in the browser; API-backed
- File Converter tools
Convert PDF↔Word, compress images, and change formats online. Free in browser · REST · MCP. No signup for typi
Related tools
security tools
Tool
Freesecurity tools
Tool
Freesecurity tools
Tool
Freesecurity tools
Tool
Freesecurity tools
Tool
Freesecurity tools
Tool
Freesecurity tools
Tool
Free
Popular in Security Tools
security tools
SPF / DKIM / DMARC Checker
Look up SPF, common DKIM selectors, and DMARC TXT records for a domain or URL hostname.
Freesecurity tools
Hash Generator
Compute MD5, SHA-1, SHA-256/384/512, or SHA-3 digests of text in one place — with legacy warnings for MD5/SHA-1.
Freesecurity tools
Secure Password Generator
Generate a cryptographically random password with configurable length and character sets.
Freesecurity tools
Password Strength Checker
Estimate password strength from length, charset mix, entropy heuristics, and a short common-password list.
Freesecurity tools
JWT Decoder
Decode JWT header and payload with weak-algorithm and expiry warnings — signature is not verified.
Freesecurity tools
Cookie Security Analyzer
Parse Set-Cookie flags for Secure, HttpOnly, and SameSite on a live URL response.
Freesecurity tools
SSL/TLS Certificate Checker
Inspect expiry, issuer, SANs, and fingerprint for an HTTPS host — client-visible certificate check, not a full SSL Labs grade.
Free