Start with the live form
Enter a domain, URL, IP, email, or record and get a focused result without setup.
All tools
Web Data
Domain Intelligence
DNS & Infrastructure
Security & Trust
Identity & Verification
Monitoring & Automation
Security headers checker
Enter a URL to see which HTTP security headers it sends, how each one scores, and what to fix first.
Results
Interactive intelligence tool
Run the check, then ship the workflow
Use the browser tool for a fast answer, then move the same logic into scripts, monitoring, or product flows when it becomes repeatable.
Review decision-ready signals
Outputs highlight statuses, risks, records, and next actions instead of raw provider noise.
Automate the workflow that works
Use the request and response examples to turn a one-off check into an API call or recipe.
Used by people at these companies
What this tool helps you decide
Each page is shaped around a practical operational question, not just a raw lookup.
See the current DNS, registration, security, pricing, or reputation evidence.
Compare the result with related checks so the next move is easier to trust.
Copy examples, open linked tools, or move into API documentation when you need scale.
Trust signals before you integrate
Transparent docs, authenticated requests, and visible reliability details make it easier to evaluate DomScan before you ship.
Service status
API artifacts
OpenAPI, Swagger, Postman, CLI, SDK, and MCP links are one click away.
API keys
Protected access
Authenticated endpoints use API keys with clear credit costs before you call them.
Free allowance
Sign up for free
Start with 10,000 monthly credits and upgrade only when usage grows.
Active
Example request
Start from the curl and HTTP samples, then map the parameters into your application code.
Key Features
Eleven checks
HSTS, CSP, clickjacking protection, nosniff, Referrer-Policy, Permissions-Policy, COOP, COEP, CORP, version disclosure and cookie flags.
Score and grade
A weighted 0 to 100 score and an A+ to F grade, with a prioritized list of recommendations.
No false grades
Error pages and bot challenges are analysed but not graded, and pages that do not answer stay unknown.
Example request
GET /v1/headers?url=https://example.comGET /v1/headers?domain=example.comBuilt on the same API
The browser experience previews DomScan's structured endpoints, so teams can validate a use case before writing code.
Frequently asked questions
How should I interpret the CSP and HSTS parts of the score?
DomScan's score weights are its own rubric, not a universal security rating. Content-Security-Policy-Report-Only does not block content; it can send violation reports only when a reporting destination is configured. If a site only publishes Report-Only, this checker marks the CSP check as a warning. Test and tailor an enforced policy before relying on it. HSTS is assessed only when the final URL uses HTTPS, and an HTTP final URL caps the grade. The includeSubDomains directive extends HSTS to all subdomains, so enable it only after each subdomain is HTTPS-ready.
Why is my site not graded?
If the page returned an error status or a bot challenge, its headers may come from a firewall or CDN rather than your application, so no grade is given.
Are cookie values shown?
No. Only cookie names and their Secure, HttpOnly and SameSite flags are reported.