Qualys SSL Labs Server Test
ssllabs.com
Grades a site's TLS configuration from A+ down to F and says why
No sign-upClassic
Loading page
securityheaders.com
Grades the HTTP security headers a site sends and names the missing ones.
Scan a URL and it reports on Content-Security-Policy, Strict-Transport-Security, X-Frame-Options, Referrer-Policy and Permissions-Policy, grading A+ to F with a short explanation and an example value for anything absent. It is the fastest way to turn 'we should harden the headers' into a specific list. It only inspects response headers on one URL, so it says nothing about whether your CSP is actually correct or merely present.
AltFTool does this too
If you would rather not leave the site, Security Headers Checker covers the same job here — free, no account, and it runs in your browser.
Open Security Headers CheckerQuestions
Works the moment the page loads. No account, no email, no trial. Checks that headers exist, not that they are correct — a permissive CSP still scores well.
Yes. Security Headers sends your input to its own servers to process it. That is fine for public material; for anything containing personal data, use one of the on-device tools instead.
Checks that headers exist, not that they are correct — a permissive CSP still scores well.
Alternatives
Same category or same task, ordered by how closely they overlap.
ssllabs.com
Grades a site's TLS configuration from A+ down to F and says why
pagespeed.web.dev
Scores a page on real-user Core Web Vitals and lab measurements
wave.webaim.org
Overlays accessibility errors directly on top of the page they affect
webpagetest.org
Loads your page from a chosen city and browser and films the result
downforeveryoneorjustme.com
Settles whether a site is actually down or only down for you
lookup.icann.org
The registry's own WHOIS record for a domain, with no upsell