Grade a URL's security headers and get the exact header to add for each gap.

Security headersFreeFor developers and site owners

Better than by hand

Names the specific header and value to add for every gap, rather than only reporting a grade. We do not put a time on it.

Before: what you give it

The example input, as typed in. You give it a page address.

https://allthepossibles.com

After: what comes back

The first lines of a real run of the tool's own code on that input, fetched live when the sample was made, so the live page can differ from it. Nothing here is edited by hand.

Grade A (92/100), HTTP 200
  OK      strict-transport-security   Set with a long max-age.
  WEAK    content-security-policy     CSP allows unsafe-inline, unsafe-eval or a bare wildcard, which gives up most of the injection protection. Move to nonces or hashes.
  OK      x-content-type-options      nosniff.
  OK      x-frame-options             Framing is controlled.
  OK      referrer-policy             Set.
  OK      permissions-policy          Set.
  OK      cache-control               Set.

What you get

A letter grade and score, each header marked ok, weak or missing with a fix, plus cookie flags and server leaks

What it cannot do

Grades one response from one URL; it does not test whether your CSP actually blocks an attack.

Who it is for

Developers
Site owners

Free and Pro

Free	20 runs a day per IP address.
Pro	No daily limit, 300 requests a minute.

Daily caps for every tool

Use it from your assistant

The tool is called check_headers. Connect the server once, then ask for it by name or describe the job. Install steps.

claude mcp add --transport http toolbox https://toolbox.allthepossibles.com/mcp

curl -X POST https://toolbox.allthepossibles.com/api/headers -H 'content-type: application/json' -d '{"url":"https://allthepossibles.com"}'

Try it here

The form starts with the same example input, so you can run it first and then swap in your own.

Page URL