SecurityHeaders.com is the header specialist
Scott Helme, a security researcher, built securityheaders.com after writing extensively about HTTP security headers, and it became the de facto standard for header grading. The tool has since changed hands. Its About page now states that it "is a part of Snyk, a leading cybersecurity company, and was originally created by Scott Helme", and every page footer carries "A snyk.io project". Scott still has input; day-to-day operation sits with Snyk. It checks the standard security headers:
- Strict-Transport-Security (HSTS)
- Content-Security-Policy (CSP)
- X-Frame-Options
- X-Content-Type-Options
- Referrer-Policy
- Permissions-Policy (formerly Feature-Policy)
- Cross-Origin-Opener-Policy (COOP)
- Cross-Origin-Embedder-Policy (COEP)
- Cross-Origin-Resource-Policy (CORP)
It grades from A+ to F. The A+ grade has become a widely-shared badge. You'll see it in countless README files, company security pages, and conference talks.
What it does really well
- Clean, focused UI: No clutter, just header analysis
- Historical tracking: Scan history shows improvements over time
- Public URLs: Every scan result is a shareable link
- Recognised scoring: The A+ grade is a widely-shared security badge
- Scale: The homepage counters show over 389 million graded scans to date
What ismycodesafe.com includes beyond headers
We check seven of the headers SecurityHeaders.com grades, on the same basis of presence plus configuration correctness. Two we do not currently check are COEP and CORP, so if those specifically are what you are tuning, use the specialist. We also flag information-leaking response headers such as Server and X-Powered-By, which a header grade does not penalise. On top of that:
- SSL/TLS deep analysis: SSLyze-powered cipher and protocol testing
- OWASP Top 10 mapping: Findings categorized by OWASP 2021
- CVE detection: NVD + OSV + retire.js for tech stack and JS libraries
- 53 sensitive file paths: .env, .git, backups, CI configs
- Threat intelligence: VirusTotal, PhishTank, AlienVault OTX, URLhaus, Spamhaus
- Shodan InternetDB: Port scan and CVE lookup for server IP
- Certificate Transparency: Subdomain discovery via crt.sh
- urlscan.io: Technology detection, DOM analysis, geolocation
- DNS security: SPF, DMARC, DKIM, CAA, MTA-STS, TLS-RPT
The paid API is gone - what that changes
If you are looking for a SecurityHeaders.com alternative because your automation stopped working, this is probably why: the securityheaders.com API has been discontinued. Their API page now reads "This service has been discontinued. We are no longer providing new subscriptions or renewing existing subscriptions", with an API Key Dashboard left in place so existing subscribers can still manage what they have.
Two honest points about what that means here. First, the free web scanner at securityheaders.com is still running, so if all you need is a header grade in a browser, nothing has broken for you. Second, we do not publish a scanning API either. If your requirement is specifically a drop-in REST endpoint for CI, we are not that today, and saying so is cheaper for both of us than letting you find out mid-evaluation.
Where we do replace it is the interactive check. Paste a URL into ismycodesafe.com and you get the same class of header grading, plus the TLS, CVE, exposed-path, and DNS checks a header grader was never built to run.
The one scan philosophy
The reason to use ismycodesafe.com over SecurityHeaders.com isn't that we grade headers better. We grade them the same way. The reason is that security isn't just headers.
A site can get A+ on SecurityHeaders.com and still be hackable because:
- Its .env file is publicly accessible
- Its jQuery version has known XSS vulnerabilities
- Its SSL uses deprecated TLS 1.0
- Its admin panel is at /admin with default credentials
- Its database port is exposed to the internet
SecurityHeaders.com won't catch any of these. It's not designed to.
Using both
SecurityHeaders.com is excellent for one specific use case: getting your header grade as high as possible and having a shareable link to prove it. ismycodesafe.com is better for weekly security audits covering the full picture.
Both are free. Use SecurityHeaders.com when you're actively tuning headers. Use ismycodesafe.com for complete security monitoring.
Pricing
SecurityHeaders.com: The web scanner is free and needs no account. The paid API tier that previously covered higher rate limits and bulk scanning was discontinued in April 2026 and is no longer sold.
ismycodesafe.com: Free basic scan (all 200+ checks). $49 for premium AI-generated report. $150 for 30-min code security consultation.
Credit where it's due
Scott Helme has done more to popularize HTTP security headers than anyone. His blog and SecurityHeaders.com have probably prevented thousands of XSS and clickjacking attacks. If you're not following his blog, you should be.
We built ismycodesafe.com because we wanted full scanning in one request, not because SecurityHeaders.com needed replacing. The two tools coexist and complement each other.
The honest summary
SecurityHeaders.com: The best HTTP header grader with a recognized A+ badge. Use it when you're tuning headers specifically.
ismycodesafe.com: Header grading plus 150+ other security checks in one scan. Use it for ongoing security audits.
If you want the reasoning behind each header rather than only a grade, the HTTP security headers guide walks through what each one blocks. If you are comparing graders more broadly, the Mozilla Observatory comparison covers the other widely-used one.
SecurityHeaders.com alternatives - FAQ
- What is the best free SecurityHeaders.com alternative?
- It depends which part you need to replace. For a browser-based header grade, securityheaders.com itself is still free and still running, so nothing has changed there. For a free scan that grades the same headers and also checks SSL/TLS configuration, CVEs in detected libraries, exposed .env and .git paths, DNS records, and threat-intelligence listings, ismycodesafe.com covers all of it in one request with no account. For a drop-in REST API replacement, neither fits: the securityheaders.com API was discontinued in April 2026 and ismycodesafe.com does not publish a scanning API yet.
- Is the SecurityHeaders.com API discontinued?
- Yes. The API page at securityheaders.com/api states that the service has been discontinued, that no new subscriptions are being sold, and that existing subscriptions are not being renewed. An API Key Dashboard remains so existing subscribers can retrieve or manage their key. The free web scanner is unaffected.
- Who owns SecurityHeaders.com now?
- Snyk. The About page states the tool is part of Snyk and was originally created by Scott Helme, and the site footer reads 'A snyk.io project'. Scott Helme still has input per that same page, but the tool is operated by Snyk's team.
- Which headers does SecurityHeaders.com grade?
- Strict-Transport-Security, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, and the three Cross-Origin headers (COOP, COEP, CORP). It grades A+ down to F based on which are present and how they are configured. ismycodesafe.com checks seven of those (HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, COOP) plus information-leaking headers such as Server and X-Powered-By, which a header grade does not penalise.
- Can a site with an A+ header grade still be insecure?
- Yes, and that is the main reason to run more than a header check. Header grading looks only at HTTP response headers. A site can return a perfect header set while serving a publicly readable .env file, running a JavaScript library with a known CVE, negotiating deprecated TLS versions, or exposing a database port. None of those affect the header grade because none of them are headers.
- Do I need both tools?
- If you are actively tuning headers toward A+, securityheaders.com gives you the canonical grade and a public result URL you can share as proof. If you want to know whether the page as a whole is safe to ship, ismycodesafe.com grades the headers as one section of a scan that also covers TLS, CVEs, exposed paths, DNS security, and threat-intelligence listings. Using the specialist while fixing headers and the broader scan as a recurring gate is a reasonable split.