What is the best free HTTP security headers checker?

A security headers checker fetches a URL and reports which HTTP response headers are present, which are missing, and which are set to a value that does not actually protect anything. The IntoDNS.ai Security Headers Generator does that and then closes the loop: it produces the exact configuration lines to fix what it found.

What gets checked

• Strict-Transport-Security (HSTS). Whether it is present, how long max-age runs, and whether includeSubDomains and preload are set. A short max-age is the most common half-measure.
• Content-Security-Policy. Present or absent, and whether it is undermined by unsafe-inline or unsafe-eval. A CSP containing unsafe-inline blocks very little of what CSP exists to block.
• X-Frame-Options and the modern frame-ancestors directive that supersedes it, against clickjacking.
• X-Content-Type-Options, which stops a browser guessing a response is a different type than declared.
• Referrer-Policy, which decides how much of the current URL leaks to the sites you link to.
• Permissions-Policy, which turns off browser features — camera, microphone, geolocation — that a site does not use.
• Cross-Origin-Opener-Policy, Cross-Origin-Embedder-Policy and Cross-Origin-Resource-Policy, the isolation headers that decide what other origins may do with your pages and resources.

Why the generator half matters

Most checkers stop at the verdict. Knowing that Permissions-Policy is missing does not tell you what to write, and the syntax is unforgiving — a single malformed directive can invalidate the header. The generator emits the finished line for Nginx, Apache, Caddy and Cloudflare, so the fix is a copy and a reload rather than an afternoon with the specification.

The CSP is a separate job

Content-Security-Policy is the one header you cannot write from a template, because it has to enumerate every origin your pages legitimately load from. The CSP Scanner crawls up to twenty pages, inventories every script, style, font, image and connection origin it finds, and produces a starter policy built from what your site actually uses. That is the difference between a CSP you can deploy and a CSP that breaks your site on the first Friday afternoon.

Checking it without a browser

Everything above is available over HTTP, with no key and no signup:

GET https://intodns.ai/api/security-headers/analyze?domain=example.com

For agents there are three MCP tools — analyze_security_headers, generate_security_headers and scan_csp — on the remote MCP endpoint at https://intodns.ai/api/mcp, so an assistant can check a site, read the gaps and produce the config in one conversation.

What a headers checker will not tell you

Headers are one layer. A site with a flawless header set can still have a domain that anyone can spoof, because SPF, DKIM, DMARC, DNSSEC and MTA-STS live in DNS and never appear in an HTTP response. A full domain scan covers both surfaces in one report.