Alternatives to Security Headers
A web service that analyses a site's HTTP response headers and grades them from A+ to F. The listings below can replace it for an important use case. Each note says what changes if you switch.
The original
Security Headers
A web service that analyses a site's HTTP response headers and grades them from A+ to F.
Replacements
Listings that take over the same core job as Security Headers.
HTTP Observatory
Mozilla's web tool that grades a site's HTTP security headers and gives fix recommendations.
HTTP Observatory from Mozilla also grades security headers, adding recommendations tied to MDN documentation and an interface in many languages, without the public recent-scans list.
Webbkoll
A web-based privacy checker for cookies, third-party requests, HTTPS and security headers.
Webbkoll checks security headers alongside cookies, third-party requests and HTTPS redirects, is run by a non-profit with published source, but gives no letter grade.
Hardenize
A web site configuration tester and monitoring service for network, certificate and security settings.
Hardenize adds network and certificate configuration to its free public report, and offers continuous monitoring aimed at organisations rather than a quick shareable grade.
Similar software
Related functionality, not a direct replacement.
CSP Evaluator
A Google web tool that checks whether a Content Security Policy mitigates cross-site scripting.
Csper CSP Evaluator
An online evaluator that analyses the directives in a Content-Security-Policy header.
HSTS Preload List Submission
A web tool to check a domain's HSTS preload status and submit it for inclusion.
SSL Labs Server Test
A Qualys web service that analyses the TLS/SSL configuration of a public web server.
Sucuri SiteCheck
Free remote scanner that checks a website for visible malware, blocklisting and outdated software.
Internet.nl
A web test that checks websites, mail domains and connections for modern Internet standards support.
