How to use Security Headers Analyzer
- Enter a public URLType the full address, including https://, into Public URL.
- Run the analysisPress Run Security Headers Analyzer; the GigaTools server then requests the page live.
- Fix missing headersThe result shows how many of the six headers are present and what each missing one would protect against.
Common uses
- Checking a site after a server or CDN change
- Confirming that HSTS is in place before a launch
- Running a quick audit of a client site’s basic hardening
Frequently asked questions
How do I use Security Headers Analyzer?
1. Enter a public URL: Type the full address, including https://, into Public URL. 2. Run the analysis: Press Run Security Headers Analyzer; the GigaTools server then requests the page live. 3. Fix missing headers: The result shows how many of the six headers are present and what each missing one would protect against.
Which headers are checked?
Strict-Transport-Security, Content-Security-Policy, X-Content-Type-Options, X-Frame-Options, Referrer-Policy and Permissions-Policy.
Does it check the header values?
No. It only reports whether each header is present. A weak or misconfigured policy still counts as present, so review the values yourself.
Is a live request made?
Yes. Each run sends a fresh HTTP HEAD request from the GigaTools server, so the result reflects the site at that moment. Redirects are followed, only the headers of the final response count, and the result shows which URL was checked. Servers that answer HEAD requests differently from normal page loads may show different headers.
What is sent and stored?
The URL goes to the GigaTools server, which requests that address. Only public addresses on the standard ports 80 and 443 are accepted, and every redirect is checked the same way before it is followed. A daily usage limit applies, and the URL is not saved.