Header scanner

The header scanner fetches a live page and grades its whole response surface, not just the policy. It covers every security header, the attributes on the cookies the response sets, and where the response sends browser reports.

Use it for a posture check on a site. Use the CSP scanner when you only care about the Content Security Policy and want the score scoped to it.

Scan a site

1. Open Tools > Header scanner.
2. Enter the address, for example example.com.
3. Leave Follow redirects on unless you want the response at that exact URL.
4. Select Scan headers.

What it checks

The overall score is labeled Overall security score and is weighted across every check in this section, so it reads lower than a CSP scan of the same site whenever headers other than the policy are missing.

Policies that emit reports

• Content Security Policy, enforced and report-only, with the same checks the CSP scanner runs.
• Permissions-Policy, Document-Policy, and Integrity-Policy.
• Cross-Origin-Opener-Policy and Cross-Origin-Embedder-Policy, including whether the pair reaches cross-origin isolation.
• Connection-Allowlist and Network Error Logging.

A policy set only in a report-only header, with no enforced counterpart, is flagged. Violations are reported but nothing is blocked.

Transport and resource headers

• Strict-Transport-Security, including a max-age below the recommended year, a missing includeSubDomains, and preload eligibility.
• Referrer-Policy, X-Content-Type-Options, X-Frame-Options, and Cross-Origin-Resource-Policy.
• X-XSS-Protection, which is deprecated and flagged when it is enabled rather than when it is absent.
• Cache-Control, and headers that advertise a technology or version for no benefit.

Cookies

Each Set-Cookie in the response is parsed and graded on Secure, HttpOnly, and SameSite. A cookie missing HttpOnly can be read by client-side JavaScript. A cookie missing Secure can be sent over plain HTTP.

The scan is unauthenticated, so it only ever sees pre-login cookies.

Read the result

Four tabs, described in full on the Tools overview:

• Findings ranks every issue and recommendation by severity and splits Security from Quality.
• Analyzed headers parses each graded header directive by directive, and adds a Cookies table with one row per cookie and a chip per attribute. A green chip is set correctly, a colored one carries the finding that flagged it.
• Raw headers lists every response header as received. Set-Cookie values are hidden here because a result can be shared. The attributes are in the cookies table instead.
• Reporting shows the endpoints the response declares and which report types reach one. See the reporting checker for how to read it.

Next steps

• CSP scanner for a policy-only score
• Reporting checker to confirm reports arrive
• Web Security reference for what each header does
• Tools overview for sharing, exporting, and limits