Security Headers runs on your own machine — the client starts it, so there is no endpoint to ping. Last commit 9 Oct 2026.
Fetch a URL's response headers and grade CSP, HSTS, X-Frame-Options and related security headers.
Nothing serious here today
Today is the operative word: we check Security Headers every 15 minutes and re-read its code on every release. Watch it and you find out the day that stops being true.
Alternatives to Security Headers
same job, measured the same wayScan a website's HTTP security headers (HSTS, CSP, framing, COOP/CORP, cookies). Score + fixes.
Grade a site's security headers with fixes and a badge; read logs or code for the defender.
Lint OpenAPI 3.x documents for missing security, responses, descriptions and versioning.
Read-only network & security recon tools (DNS, TLS, headers, CORS) for AI agents, each graded.
DNS resolution, HTTP security headers, and SPF/DMARC email hygiene audits.
Cybersecurity training, simulation, and incident response MCP server
Reads security headers and CSP line by line in your config file and names the lines that silently do
Security tools for your AI: scan, pentest, check headers, guard code and scan repos for secrets.
Security Headers — questions
Answers built from our own checks of this server.