attackedge
PricingSecurityBlogFAQ
Sign inStart a scan
attackedge

External security scans for small businesses. Plain-English findings, IT-ready fixes, priced for SMBs.

hello@attackedge.io

Product

Free checkHow it worksWhat we checkPricingFAQ

Trust

SecuritySample reportBlogFounder

Account

Sign inSign upSupport

Legal

TermsPrivacyRefundAcceptable use
© 2026 ArmoniaLabs · Australian registered business name · Made in AustraliaStatus unavailable
Free tool

Security headers checker.

Paste a URL. We fetch the response, read the security headers your site sends to browsers, and grade them A+ to F. Plain-English fix for every header that needs work, including HSTS, CSP, X-Frame-Options, Referrer-Policy and Permissions-Policy.

Single GET · no signup · 10 seconds

Paste the URL. We'll read the headers.

One GET request to your URL with a clear user-agent (AttackEdge-SecurityHeadersChecker/1.0). No auth, no crawling.

url
grades 8 headers · including HSTS, CSP, X-Frame-Options
What this tells you

Four headers worth understanding.

Every browser knows how to act on these headers. Your job is just to publish them. None of them break a normal site.

HSTS

Strict-Transport-Security tells browsers to refuse plaintext HTTP for your domain. Once a browser has seen the header, it will not honour an HTTP link to your site even if the user types http://.

CSP

Content-Security-Policy is the only browser-level defence that can stop a cross-site-scripting payload from running. Start in report-only with default-src 'self' and tighten from there.

X-Frame-Options

Blocks click-jacking by refusing to render your site inside an iframe on another origin. DENY for most sites; SAMEORIGIN if you embed your own UI.

Permissions-Policy

Lets you switch off browser features you do not use — camera, microphone, geolocation, payment APIs. If a script ever does try to call them, the browser refuses outright.

Want this regularly?

Security headers are one of about thirty external checks.

AttackEdge Monitoring re-runs security headers, TLS, DMARC, SPF, DKIM, MTA-STS and the rest on a recurring schedule. Plain-English findings, IT-ready fixes, monthly PDF.

Start from A$39/mo →View sample reportRun a full free check

Setup in 60 seconds · Cancel anytime

Common questions

Security headers, in plain English.

  • A security header is a directive your web server sends with every page response that tells the browser how to defend itself. Strict-Transport-Security forces HTTPS, Content-Security-Policy blocks injected scripts, X-Frame-Options stops click-jacking. Browsers honour them automatically — your site just has to publish them.
Check the others

More single-record tools.

Each tool is focused. Each one publishes the raw record and a plain-English read.

  • SPF checkerConfirm which senders are authorised to send for your domain.
  • DKIM checkerProbe a specific selector or the common defaults.
  • All four at onceSPF, DKIM, DMARC and MTA-STS in a single combined report.
  • MTA-STS checkerTXT plus the HTTPS-served policy file, validated together.