Free tool
Site scanner
Enter a URL and the page is fetched once and graded. You get a letter, the reason it is capped there, and findings that say what to change and why. One scan covers the Content Security Policy, the other security headers, and whether the site reports anything.
One request from AWS, following up to ten redirects, with no cookies and no login. The result is kept for thirty days at a link you can share, and a page scanned in the last five minutes returns the same result.
Scan result
The letter is capped by the worst structural gap; the score counts every finding. How scans are graded
Next actions
Up to five, in the order that raises the grade furthest.
Content Security Policy
Other headers, cookies and scripts
Visibility
Policies found
Each policy by directive. A source a finding quotes is marked.
Response headers
As the final URL sent them, afterno redirects. Cookie values are never kept.
What a scan cannot see
- Scripts a page adds at run time. The scan reads the HTML the server sent, not what JavaScript did to it afterwards.
- Pages behind a login. The scanner arrives with no cookies and no account.
- A different policy on another path. One URL is scanned; a site that sets headers per route can grade differently on each.
What this tool sends, and what it keeps
Everything you paste into the other tools on this site is handled in your browser. Reading a site's headers means fetching the site, so the URL you enter goes to HeaderHawk's scanner, which makes one GET request from AWS, reads the headers and up to two megabytes of the page, and stops after ten seconds. The request identifies itself as HeaderHawkScanner with a link to this page. Scans come from no fixed address, so they cannot be allowlisted by IP. One other request leaves AWS: the scanner asks hstspreload.org whether the host that answered is on the HSTS preload list, sending only the hostname and giving up after two seconds.
What is kept: the host and path, the redirect chain, the response headers with every cookie value removed, and the findings, for thirty days at the result's link. Your own address sits in a rate-limit counter for ten minutes and nowhere else. There is no public list of recent scans, and a result is reachable only by its link.
One line outlives that: the host, the grade and how many findings of each severity, kept for a year so we can see how many scans run and what they find. It holds no path, no headers and no address. It does carry the result's id, so HeaderHawk staff can open a result from our internal console for the thirty days it is kept.
If you run a site and would rather it were not scanned, email support@headerhawk.com with the hostname and it is added to the opt-out list.
See what your policy blocks on real traffic
A scan reads the header. Only violation reports show what the policy does to visitors: the vendor tag added last week, the inline handler in one old template. Point the reporting directives at HeaderHawk and they arrive grouped by directive, blocked source and page.