Migration-ready alternative for the SecurityHeaders.com API
Scan any domain's HTTP security headers in 30 seconds with Hard2bit Scanner — and get 24 more security controls in the same report.
No agents, no internal access. Just your domain. 100% passive analysis.
HTTP security headers are directives that a web server sends to the browser with every response, telling it how to protect the page: blocking mixed content, restricting which scripts can run, preventing clickjacking, or enforcing HTTPS. They are the first line of defence against XSS, MITM and session hijacking.
Unlike TLS certificates, headers are configured at the application or web server layer (Nginx, Apache, Cloudflare, CDN) and their absence does not break the site. That's exactly why they are so commonly missing: many teams omit them out of unawareness, not technical limitation.
A security headers test analyses the HTTP response of a production domain and verifies which critical headers are present, absent or misconfigured. The output is a grade (A+ to F) reflecting the site's public defensive posture.
Hard2bit Scanner checks 8 critical headers on every scan. Each one covers a distinct attack vector. These are the recommended values for 2026 (aligned with the OWASP Secure Headers Project, MDN and the CSP3 working group).
Tells the browser to connect only over HTTPS for a defined period (typically 1 year). Prevents downgrade attacks and MITM on public WiFi. Recommended value: `max-age=31536000; includeSubDomains; preload`. When missing, an attacker can intercept the user's first HTTP request and steal credentials before the redirect to HTTPS happens.
Defines which origins may load scripts, styles, images and connections. It is the most effective defence against reflected or stored XSS in SPA applications. Recommended value: strict policy with `default-src 'self'`, `script-src 'self' 'nonce-...'`, `object-src 'none'`. Without CSP, an XSS in any dependency executes freely with the user's session cookies.
Prevents the site from being loaded inside an iframe on another domain. Blocks clickjacking, where a malicious site overlays invisible buttons on top of your UI. Recommended value: `DENY` (or `SAMEORIGIN` if you need to embed your own content). Partially superseded by CSP's `frame-ancestors` directive, but worth keeping for legacy browser compatibility.
Controls how much referer information is sent when navigating to other sites. Mitigates leaks of URLs carrying tokens, internal IDs or session parameters. Recommended value: `strict-origin-when-cross-origin` (sends only the origin, not the path, on cross-domain navigation). Without it, a link to an external service can leak the full URL of your private dashboard.
Limits which browser APIs the site may use (camera, microphone, geolocation, sensors). Replaces the deprecated `Feature-Policy`. Recommended value: deny-by-default for every feature you don't need (`camera=(), microphone=(), geolocation=(), payment=()`). When missing, injected scripts can reach these APIs without the site owner's explicit consent.
Blocks browser MIME sniffing. Without this header, a file uploaded as `.txt` but containing HTML can be rendered as a full page. Recommended value: `nosniff` (the only valid value). Trivial to set, zero side effects — its absence signals that the team has not reviewed basic security.
Isolates the document's browsing context from other origins, removing `window.opener` references that would otherwise enable tabnabbing or cross-origin Spectre attacks. Recommended value: `same-origin` for sensitive sites, `same-origin-allow-popups` if you open OAuth flows in a popup. Required to use APIs such as `SharedArrayBuffer` or `performance.measureUserAgentSpecificMemory()`.
Restricts which origins can include your resources (scripts, images, fonts) via `<script>`, `<img>`, etc. Defends against Spectre attacks and exfiltration of private data. Recommended value: `same-origin` for APIs and internal endpoints, `cross-origin` for public cacheable assets. Acceptable to omit on static sites, critical on backends serving session data.
The grade reflects what percentage of the 8 critical headers are present and configured with safe values. It is not an opinion: each header has objective thresholds (for example, `Strict-Transport-Security` needs a `max-age` of at least 31536000 seconds to count as configured).
Some analyses also penalise suboptimal values (CSP with `unsafe-inline`, HSTS without `includeSubDomains`). Hard2bit Scanner follows this convention: a header that is present but weak weighs less than one configured correctly.
The grade is useful to compare posture across domains, but it does not replace a full audit. A site with an A+ on headers may still carry serious application vulnerabilities; a site with a C can be perfectly safe if it compensates with WAF, strong authentication and monitoring.
8/8 + strong values
Exemplary posture, ready for external audit.
7-8/8
Solid posture, only fine-tuning left.
5-6/8
Basic headers in place, modern layers missing (COOP/CORP).
3-4/8
Minimal configuration. Exposed to specific vectors.
0-2/8
Critical posture. Any application vulnerability is amplified.
| Grade | Headers correct | Posture |
|---|---|---|
| A+ | 8/8 + strong values | Exemplary posture, ready for external audit. |
| A | 7-8/8 | Solid posture, only fine-tuning left. |
| B | 5-6/8 | Basic headers in place, modern layers missing (COOP/CORP). |
| C | 3-4/8 | Minimal configuration. Exposed to specific vectors. |
| D / F | 0-2/8 | Critical posture. Any application vulnerability is amplified. |
The SecurityHeaders.com REST API (operated by Snyk since 2022) was retired on April 1st, 2026. Teams that integrated it into CI/CD pipelines, SOC dashboards or DevSecOps tooling lost overnight the ability to score HTTP headers programmatically.
Hard2bit Scanner covers the same analysis surface — and quite a bit more. It is not a drop-in replica (the JSON shape, response codes and authentication scheme differ), but migration is straightforward: swap the endpoint and remap the response fields per the table below.
| SecurityHeaders.com field | Hard2bit Scanner equivalent |
|---|---|
| score (A+ → F) | findings[type=security_headers].grade |
| strict_transport_security | findings[type=security_headers].details.hsts |
| content_security_policy | findings[type=security_headers].details.csp |
| x_frame_options | findings[type=security_headers].details.x_frame_options |
| referrer_policy | findings[type=security_headers].details.referrer_policy |
| permissions_policy | findings[type=security_headers].details.permissions_policy |
| x_content_type_options | findings[type=security_headers].details.x_content_type_options |
Historical reference for the SecurityHeaders.com documentation is available on the archive.org Wayback Machine. Wayback Machine: SecurityHeaders.com (2026 snapshot) .
HTTP headers are only one of the 16 categories Hard2bit Scanner analyses on every run. The same scan covers TLS and certificate configuration, DNS records (SPF/DKIM/DMARC/MTA-STS/BIMI), admin panel exposure, JavaScript libraries with public CVEs, subdomains discovered via Certificate Transparency, known vendor breaches in HIBP, leaked secrets in Lovable/Vercel/Netlify builds, and much more. It is the same tool — only the entry point changes.
Authorship
This page is technically signed by the Hard2bit S.L. security team, with named and traceable owners.
CEO and co-founder · Hard2bit S.L.
Co-founder of Hard2bit in 2013. Over 25 years of experience in cybersecurity, digital forensics and IT infrastructure. Drives a vision built on technical rigour, close client relationships and end-to-end delivery, focused on audit, ENS/ISO 27001 compliance and consulting for public administration and banking.
LinkedInCOO and co-founder · Hard2bit S.L.
Co-founder of Hard2bit. Background in offensive security, cloud architecture and SOC operations. Co-drives Hard2bit Scanner's R&D agenda contributing across the technical, operational and development perspectives, supported by the development, research and analysis team.
LinkedInTechnically reviewed on May 30, 2026 by the Hard2bit S.L. security team. Accreditations: ENS High category · ISO 27001 · ISO 22301 · CIF B86717147.