Header Hound

HeaderHound helps you check a website’s HTTP security headers and understand the results. These headers tell browsers how to handle content and apply security protections.
Enter a URL to receive a letter grade from A+ to F, scores and explanations for individual headers, and a list of headers that reveal server or content management system (CMS) versions. Use the findings to identify configuration improvements and share results with your site administrator, developer, or hosting provider.

Features

- Security header audits: Fetch a URL and evaluate ten HTTP response headers.
- Clear results: Get an overall letter grade, individual header scores, and short explanations.
- Version disclosure checks: Identify headers that reveal server or CMS versions.
- Raw response headers: Review the complete set of headers returned by the website.
- Portable reports: Download a self-contained HTML report that opens offline and prints cleanly to PDF.
- Optional public checker: Enable the included HeaderHound Public submodule to let visitors run audits at /security-headers.
- Shareable results: Each public audit receives its own report link.
- Recent audit listing: Display recent audits publicly, with an option for visitors to exclude their audit from the list.
Use HeaderHound when reviewing a new website, checking header changes after deployment, or preparing findings to share with a client or technical team.
The module checks:
- Content-Security-Policy
- Strict-Transport-Security
- X-Frame-Options
- X-Content-Type-Options
- Referrer-Policy
- Permissions-Policy
- X-XSS-Protection
- Cross-Origin-Embedder-Policy (COEP)
- Cross-Origin-Opener-Policy (COOP)
- Cross-Origin-Resource-Policy (CORP)

Post-Installation

After enabling HeaderHound, use its audit interface to enter the URL you want to check. Review the resulting grade, header explanations, and raw response headers, or download the report for offline use.
To offer a public checker, also enable the included HeaderHound Public submodule. The checker is available at /security-headers, where visitors can run audits and share report links.
HeaderHound reports on the headers a website returns. Changes to those headers must be made separately in the website, web server, or hosting configuration.