headertest.com

What It Is

HeaderTest is a free online security response header scanner. Its core purpose is to analyze a website’s Content Security Policy (CSP) and other HTTP security response headers, helping developers and security teams identify configuration issues related to common web risks such as XSS, clickjacking, and data injection. It is lightweight to use: enter a website URL and get real-time analysis. The site emphasizes that it requires no registration, is free, and allows unlimited scans.

Core Capabilities

In terms of protection coverage, HeaderTest focuses on CSP directive validation, checking the presence and values of security headers, comparison against best practices, risk scoring, vulnerability/threat detection, and SSL/TLS verification. The listed checks include Content-Security-Policy, X-Content-Type-Options, X-Frame-Options, Strict-Transport-Security, Referrer-Policy, Permissions-Policy, Cross-Origin-Opener-Policy, and more, making it suitable for assessing a web application’s security baseline. Reports provide detailed recommendations, priority-based findings, and remediation guidance, but the main description does not indicate support for continuous monitoring, alerting, team permissions, or centralized management.

Pricing and Deployment

Pricing is very clear: completely free, no registration required, and unlimited website scans. Deployment is via an online web tool. The main content does not mention self-hosted deployment, CLI, API, or CI/CD integration, so it is better suited to quick checks and manual review than as an enterprise-grade component in an automated DevSecOps pipeline. No specific compliance certifications are disclosed.

Pros and Cons

Its strengths are a low barrier to entry, real-time scanning, coverage of common security headers, and actionable recommendations. It can directly help development teams fix issues such as unsafe-inline or unsafe-eval in CSP, missing HSTS, or absent X-Frame-Options. Its limitations are that the product scope is relatively narrow: it is primarily a configuration-checking tool and does not provide broader security platform capabilities such as WAF, exploit validation, asset management, or alert orchestration. Information on integrations and service support is also limited.

Who It’s For and Access from China

HeaderTest is suitable for individual developers, small and mid-sized teams, security consultants, and organizations that need to quickly verify security header configurations before launch or during routine inspections. The main content does not provide information about access from mainland China, so this remains unknown. Payment is not an issue, as the service claims to be free to use. As alternatives or complements, Mozilla Observatory, SecurityHeaders.com, Qualys SSL Labs, or OWASP ZAP are worth considering.