Agent X Alpha

Security Scanner

Server API

Scan any website for security misconfigurations. Checks 12 security headers and gives an A+ to F grade.

Quick Test:

12 Security Protocols

Comprehensive inspection of HTTPS, HSTS preload, CSP, X-Frame-Options, cookie security flags, server header leakage, and CORS policies.

Algorithmic Grading

Weighted security posture scoring and letter grade (A+ through F) derived from OWASP, Mozilla Observatory, and global industry best practices.

1-Click Remediation

Instant copy-paste configuration snippets for Nginx, Apache, Caddy, Next.js, and Vercel to harden missing and weak headers.

Frequently Asked Questions

What does this Web Security Header Scanner check?
It inspects your website HTTP response headers for essential security controls including Strict-Transport-Security (HSTS), Content-Security-Policy (CSP), X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy, awarding an overall A+ to F security posture grade.
Why are security headers critical for web apps?
Security headers provide defense-in-depth protection against clickjacking, cross-site scripting (XSS), MIME-sniffing, and SSL stripping without modifying your core application code.
Can I scan private intranet or localhost addresses?
Because scans are dispatched through our secure edge probe, targets must be publicly resolvable via DNS over HTTPS.
Recommended For You

More Security & Privacy Utilities

View all Security & Privacy tools
Security & Privacy

DMARC, SPF & DKIM Email Security Auditor & Generator

Audit live DMARC, SPF, DKIM, and BIMI DNS records. Detect 10-lookup SPF limit violations, spoofing vulnerabilities, and generate copy-paste DNS records and 2048-bit DKIM keys.

Network APILaunch
Security & Privacy

TOTP / 2FA Authenticator Simulator

Simulate, generate, and verify RFC 6238 Time-based One-Time Passwords with interactive countdowns, URI import, SHA-1/256/512 algorithms, and clock drift testing.

Client-SideLaunch
Security & Privacy

PII & Secret Log Redactor / Masker

Scrub credentials, API keys, passwords, credit cards, emails, and PII from production logs and error stack traces 100% locally in your browser before sharing.

Client-SideLaunch