Analyze Your Website's
Security Headers
Instantly scan and validate Content Security Policy (CSP) headers. Identify vulnerabilities and strengthen your web application's defense.
Comprehensive Security Analysis
Deep inspection of your security headers and policies
CSP Validation
Comprehensive Content Security Policy analysis with directive-by-directive validation
XSS Protection
Detect potential cross-site scripting vulnerabilities and unsafe inline scripts
Security Headers
Check for X-Frame-Options, HSTS, and other critical security headers
How It Works
Scan your website in three simple steps
Enter Your URL
Type your website address into the scanner above. We support any publicly accessible URL.
Get Your Analysis
We fetch and analyze your HTTP response headers, CSP directives, and security configuration in seconds.
Fix & Improve
Follow our prioritized recommendations to strengthen your security headers and improve your score.
Detailed Security Reports
Get actionable insights and recommendations
Latest from the Blog
Security insights and best practices
How to Add a Content Security Policy to a Next.js App
July 18, 2026
Next.js emits inline hydration scripts, so a naive script-src blocks your own app. Here is the clean nonce + strict-dynamic setup in middleware, plus the styled-jsx and next/image gotchas.
How to Add Security Headers in Nginx
July 18, 2026
Nginx sets response headers with add_header. Here is a copy-paste server block for HSTS, X-Frame-Options, nosniff and more — plus the inheritance trap that silently drops your headers inside a location block.
How to Add Security Headers in Apache
July 18, 2026
Apache sets headers with mod_headers. Here is a copy-paste config for HSTS, X-Frame-Options, nosniff and more — and why you want Header always set rather than Header set.