# Header scanner (/en/docs/platform/tools/security-header-scanner)



The header scanner fetches a live page and grades its whole response surface, not just the policy. It covers every security header, the attributes on the cookies the response sets, and where the response sends browser reports.

Use it for a posture check on a site. Use the [CSP scanner](/en/docs/platform/tools/csp-scanner) when you only care about the Content Security Policy and want the score scoped to it.

## Scan a site [#scan-a-site]

1. Open **Tools** > **Header scanner**.
2. Enter the address, for example `example.com`.
3. Leave **Follow redirects** on unless you want the response at that exact URL.
4. Select **Scan headers**.

## What it checks [#what-it-checks]

The overall score is labeled **Overall security score** and is weighted across every check in this section, so it reads lower than a CSP scan of the same site whenever headers other than the policy are missing.

### Policies that emit reports [#policies-that-emit-reports]

* [Content Security Policy](/en/docs/web-security/policies/content-security-policy), enforced and report-only, with the same checks the [CSP scanner](/en/docs/platform/tools/csp-scanner) runs.
* [Permissions-Policy](/en/docs/web-security/policies/permissions-policy), [Document-Policy](/en/docs/web-security/policies/document-policy), and [Integrity-Policy](/en/docs/web-security/policies/integrity-policy).
* [Cross-Origin-Opener-Policy](/en/docs/web-security/policies/cross-origin-opener-policy) and [Cross-Origin-Embedder-Policy](/en/docs/web-security/policies/cross-origin-embedder-policy), including whether the pair reaches cross-origin isolation.
* [Connection-Allowlist](/en/docs/web-security/policies/connection-allowlist) and [Network Error Logging](/en/docs/web-security/policies/network-error-logging).

A policy set only in a report-only header, with no enforced counterpart, is flagged. Violations are reported but nothing is blocked.

### Transport and resource headers [#transport-and-resource-headers]

* [`Strict-Transport-Security`](/en/docs/web-security/security-headers/strict-transport-security), including a `max-age` below the recommended year, a missing `includeSubDomains`, and preload eligibility.
* [`Referrer-Policy`](/en/docs/web-security/security-headers/referrer-policy), [`X-Content-Type-Options`](/en/docs/web-security/security-headers/x-content-type-options), [`X-Frame-Options`](/en/docs/web-security/security-headers/x-frame-options), and [`Cross-Origin-Resource-Policy`](/en/docs/web-security/security-headers/cross-origin-resource-policy).
* [`X-XSS-Protection`](/en/docs/web-security/security-headers/deprecated-headers), which is deprecated and flagged when it is enabled rather than when it is absent.
* [`Cache-Control`](/en/docs/web-security/security-headers/cache-control), and [headers that advertise](/en/docs/web-security/security-headers/information-disclosure-headers) a technology or version for no benefit.

### Cookies [#cookies]

Each `Set-Cookie` in the response is parsed and graded on [`Secure`, `HttpOnly`, and `SameSite`](/en/docs/web-security/security-headers/cookie-security). A cookie missing `HttpOnly` can be read by client-side JavaScript. A cookie missing `Secure` can be sent over plain HTTP.

The scan is unauthenticated, so it only ever sees pre-login cookies.

## Read the result [#read-the-result]

Four tabs, described in full on the [Tools overview](/en/docs/platform/tools):

* **Findings** ranks every issue and recommendation by severity and splits Security from Quality.
* **Analyzed headers** parses each graded header directive by directive, and adds a **Cookies** table with one row per cookie and a chip per attribute. A green chip is set correctly, a colored one carries the finding that flagged it.
* **Raw headers** lists every response header as received. `Set-Cookie` values are hidden here because a result can be shared. The attributes are in the cookies table instead.
* **Reporting** shows the endpoints the response declares and which report types reach one. See the [reporting checker](/en/docs/platform/tools/reporting-api-checker) for how to read it.

## Next steps [#next-steps]

* [CSP scanner](/en/docs/platform/tools/csp-scanner) for a policy-only score
* [Reporting checker](/en/docs/platform/tools/reporting-api-checker) to confirm reports arrive
* [Web Security reference](/en/docs/web-security) for what each header does
* [Tools overview](/en/docs/platform/tools) for sharing, exporting, and limits