Check your security headers — and get the fix, not a grade
Most AI-built sites run with whatever the host sends by default. We check the headers, cookies and certificate on your live site and tell you what to add, in priority order, for the host you use.
Free, no sign-up. The basic check makes only the requests an ordinary browser would.
What we check
- MediumFree check
Content-Security-Policy
Missing, or weakened by unsafe-inline, wildcards or missing directives — we name the part that lets scripts through.
- MediumFree check
HSTS and the HTTPS redirect
Whether plain HTTP redirects to HTTPS and whether browsers are told to never use HTTP again, for long enough.
- MediumFree check
Clickjacking and cookie flags
Whether the page can be framed by another site, and which cookies lack Secure, HttpOnly or SameSite.
- HighFree check
Certificate and TLS
Expiring or expired certificates, outdated protocol versions and mixed content.
Headers set for your host
Vercel, Netlify, Cloudflare and your own server set headers in different places. The report’s prompt tells your AI where.
Fix these issues on example.com. 1. No Strict-Transport-Security header. Add: Strict-Transport-Security: max-age=31536000; includeSubDomains 2. The page can be framed by any site. Add Content-Security-Policy: frame-ancestors 'self' When done, re-check: https://scanyoursite.app/en?check=example.com
Certificates expire on a Sunday
With Pro we watch the certificate and the headers daily and warn you before expiry — not after.
See plansQuestions
Why not just a letter grade?
A grade tells you something is wrong. A fix tells you what to change and where.
Will adding a CSP break my site?
It can if it is too strict. The suggested policy starts from what your page actually loads, and you can test it in report-only mode first.
Is the check safe?
Yes. It reads the same responses any browser receives.
Paste your URL. Get the list in about a minute.
Every finding comes with what it means for you and how to fix it — or a prompt your AI coding tool can apply.
Free, no sign-up. The basic check makes only the requests an ordinary browser would.