Tools / Security headers

Security headers analyzer

Fetches the page once and grades its HTTP response security headers from A+ to F — which are present, which are missing, and which are set but weak.

What it checks

Content-Security-Policy — an important browser-side XSS mitigation (weighted highest); also flags 'unsafe-inline' / 'unsafe-eval' and wildcard default-src.
Strict-Transport-Security — plus whether it has includeSubDomains, preload and a long enough max-age.
X-Content-Type-Options, X-Frame-Options (or CSP frame-ancestors), Referrer-Policy, Permissions-Policy.
Cross-Origin-Opener-Policy, Cross-Origin-Resource-Policy, Cross-Origin-Embedder-Policy for cross-origin isolation.
Version disclosure in Server / X-Powered-By, and a deprecated non-zero X-XSS-Protection.

Passive GET only — no crawling, no authentication, no payloads.
Headers are read from the final response after redirects.
For the full picture (TLS, DNS, cookies, mixed content, reputation) run the free web scan.