Is a low score always a vulnerability?

Headers are one layer. A missing CSP on a static site differs from an API that sets cookies; prioritize based on data sensitivity.

Can I test internal hosts?

Only URLs reachable from your browser (or the proxy) can be analyzed. Private RFC1918 hosts are not reachable from our infrastructure.

Security Headers Analyzer

Why use Security Headers Analyzer?

Misconfigured HSTS, missing CSP, or permissive CORS multiply risk for APIs that handle webhooks and OAuth callbacks. Point this tool at any HTTPS URL to see which security headers are present, which are weak, and what engineers usually tighten before a security review.

Practical tips

Scan both marketing sites and API subdomains; teams often harden only one.
Compare results after CDN changes—Cloudflare and Fastly can strip or inject headers.
Pair with CORS Checker when APIs are called from browser-based dashboards.

Common questions

Is a low score always a vulnerability?: Headers are one layer. A missing CSP on a static site differs from an API that sets cookies; prioritize based on data sensitivity.
Can I test internal hosts?: Only URLs reachable from your browser (or the proxy) can be analyzed. Private RFC1918 hosts are not reachable from our infrastructure.