Security Headers Scanner
Grade any URL's HTTP response headers against the OWASP / Mozilla Observatory checklist. We inspect HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, cookie flags, and COOP/COEP/CORP — and tell you exactly what to add.
Scan a URL
We follow redirects, then grade the final response. No login, no rate limit beyond basic abuse protection.
What the grade means
• A+/A — HSTS with preload + long max-age, strict CSP, X-Frame-Options, X-Content-Type-Options, a strong Referrer-Policy, and Permissions-Policy all present.
• B/C — The basics are there but something is weak: loose CSP, short HSTS max-age, or missing Permissions-Policy.
• D/F — Missing critical headers. Most commonly: no CSP, no HSTS, server version leaking, or still on HTTP.
What this tool checks: HTTPS · Strict-Transport-Security · Content-Security-Policy · X-Frame-Options · X-Content-Type-Options · Referrer-Policy · Permissions-Policy · Server / X-Powered-By leakage · Cookie flags (Secure, HttpOnly, SameSite) · COOP/COEP/CORP.
• B/C — The basics are there but something is weak: loose CSP, short HSTS max-age, or missing Permissions-Policy.
• D/F — Missing critical headers. Most commonly: no CSP, no HSTS, server version leaking, or still on HTTP.
What this tool checks: HTTPS · Strict-Transport-Security · Content-Security-Policy · X-Frame-Options · X-Content-Type-Options · Referrer-Policy · Permissions-Policy · Server / X-Powered-By leakage · Cookie flags (Secure, HttpOnly, SameSite) · COOP/COEP/CORP.
These tools are free and need no account.
They check one page at a time. RankCause itself does the thing they can’t:
it watches your pages over time and tests whether a change you made
actually moved a ranking.