HTTP header audits · free to the public

Sniff out missing HTTP headers.

Paste a URL. HeaderHound fetches it, grades its security headers from A+ to F, sniffs out headers that leak your server and CMS versions, and shows every response header with plain-language fixes.

GET

Free, no sign-up. Each report gets its own shareable link. See what others sniffed →

HeaderHound, a bespectacled bloodhound in a navy hoodie, inspecting a scroll of HTTP headers with a magnifying glass.

Every header, every response

What the hound sniffs

Security headers get a score. Everything else gets a good sniff and a place in your report.

  • Ten security headers, graded

    Each browser-hardening header is scored, explained and given a recommended value. Missing and weak headers cost points, and the total becomes a grade from A+ to F.

    • content-security-policy
    • strict-transport-security
    • x-frame-options
    • x-content-type-options
    • referrer-policy
    • permissions-policy
    • x-xss-protection
    • cross-origin-embedder-policy
    • cross-origin-opener-policy
    • cross-origin-resource-policy

  • Version leaks

    Server banners and framework fingerprints give attackers a head start. The hound flags each one with a risk level and advice.

    • server
    • x-powered-by
    • x-generator
    • x-aspnet-version
    • x-drupal-cache

  • Every response header

    The full raw response comes with every report, so you can check caching, CORS and cookies alongside the security headers.

    • cache-control
    • vary
    • access-control-allow-origin
    • set-cookie
    • content-type

  • Reports you can share

    Every audit gets its own link. Download a self-contained HTML report that opens offline and prints cleanly to PDF for your developer, host or client.

    • /security-headers/report/…
    • report.html
    • print → PDF

Live

Freshly sniffed

All recent audits →
  1. F jamestarleton.com Sun, 15 Nov 2026 - 19:18 35% 35%
  2. C github.com Sun, 15 Nov 2026 - 18:45 66% 66%
  3. D www.drupal.org Sun, 15 Nov 2026 - 18:45 52% 52%

How it works

Point. Sniff. Fix.

  1. Point it at a URL

    Any public http:// or https:// address. HeaderHound follows up to five redirects to the page that actually answers.

  2. The hound reads every header

    Ten security headers are scored against current best practice, and every header is checked for version leaks.

  3. Get a graded report

    A grade from A+ to F, plain-language findings, recommended values, a shareable link and an HTML export.

Sniff your site

GET https://example.com/

HTTP/2 200 · 1 redirect · 142 ms

strict-transport-security max-age=63072000; includeSubDomains; preload
content-security-policy missing
x-content-type-options nosniff
referrer-policy unsafe-url
permissions-policy missing
cross-origin-opener-policy same-origin
x-powered-by PHP/8.1.2 (version leaked)
Sample output. Your mileage, and your headers, will vary.

A bloodhound for HTTP headers. It sniffs out what is missing, misconfigured or leaking, one response at a time.

Free to the public

HTTP/1.1 200 OK © 2026 HeaderHound