Free, no signup, runs entirely in your browser — your data never leaves your device.
Fetches your URL once from the edge and audits nine security headers — HSTS, Content-Security-Policy, X-Content-Type-Options, X-Frame-Options/frame-ancestors, Referrer-Policy, Permissions-Policy, COOP, COEP and CORP — then scores the site A+ to F. For every missing header you get ready-to-paste nginx, Apache and Express config generated from what your site actually lacks.
curl "https://security-headers-formatho.filesformatho.workers.dev/api?url=formatho.com"
curl -X POST https://security-headers-formatho.filesformatho.workers.dev/api \
-H 'Content-Type: application/json' \
-d '{"url":"https://example.com","method":"HEAD"}'
Parameters: url — the page to scan (bare domains default to https); method — GET (default) or HEAD. Redirects are followed (≤5) and reported. Private/loopback hosts are refused.
{"url":"https://example.com/","https":true,"score":95,"grade":"A",
"checks":[{"id":"hsts","title":"Strict-Transport-Security","weight":20,
"earned":20,"status":"pass","detail":"max-age 31536000s, includeSubDomains"}, ...],
"snippets":{"nginx":"add_header ...","apache":"Header always set ...","express":"res.setHeader(...)"}}
The URL you enter is fetched once to read response headers — nothing is logged or stored. No signup, no cookies, no rate limits on your own site's checks. Fully in-browser scanning also available in the full security headers tool on formatho.com.
Browse every free Formatho Worker tool on the Formatho Tools index.