Nine headers that decide whether your site survives an XSS.
Paste any public URL. The checker fetches it once, inspects the response headers against the OWASP Secure Headers Project baseline plus the newer cross-origin isolation trio (COOP / COEP / CORP), and hands back a letter grade with a remediation hint for anything missing or weak. Twenty scans per IP per hour.
The baseline every web team should pass.
Nine response headers across three groups: content policy (CSP, Permissions-Policy), transport integrity (HSTS, X-Content-Type-Options, X-Frame-Options, Referrer-Policy), and cross-origin isolation (COOP, COEP, CORP). Each one is scored present / weak / absent, with a remediation note pointing at the exact value we expect.
References: OWASP Secure Headers Project (2024), MDN Web Docs headers reference, W3C Cross-Origin-Isolation spec.
Want more than a header scan?
Our full audit sweep covers TLS grade, DNS posture, authorisation-adjacent business logic, and multi-tenant BOLA / BFLA. Three tiers, from automated to grey-box engagement.
See audit services →