About HeaderAudit
HeaderAudit requests a URL, reads the response headers, and reports what they protect against. It never stores what you scan and never reads the response body.
What makes it different
The CSP analysis. Most scanners check whether a directive contains a dangerous value and stop
there, which produces two systematic errors: flagging 'unsafe-inline' as critical when
a nonce makes it inert, and treating a host allowlist as meaningful when
'strict-dynamic' makes browsers ignore it. Both are handled correctly here, and both
are explained rather than just scored.
The analysis in your browser and the analysis on the server are the same code — the CSP module is shared between them, so the two cannot drift apart.
What it cannot tell you
Headers are only what a server declares. A site can send a perfect CSP and still be vulnerable through a bug the policy does not cover, and a site with no headers may have no attack surface worth the name. A grade here is a measure of defensive configuration, not of whether a site is secure.
It also only sees the homepage. Applications frequently set different headers on authenticated routes.
Sister site
InboxAudit — SPF, DKIM and DMARC checker.