Enter a domain. Each header is scored, missing ones are listed with the points they cost, and headers that leak your server version are flagged.
Free, 60 uses a day per address, nothing stored. The same thing from your own code: Domain & Mail Security API.
Content-Security-Policy, by a wide margin: it is the one that actually stops injected script from running. It is also the hardest to deploy, which is why so many sites have every other header and not this one.
Publishing your exact server and version tells an attacker which CVE list to work through. It buys you nothing. server_tokens off in nginx, or the equivalent, removes it.
Written by a network administrator who was tired of paying per domain. Counts SPF DNS lookups against the RFC 7208 limit of 10 (the usual silent cause of delivery loss), probes 28 DKIM selectors, parses DMARC, grades the result A to F.
curl -X POST "https://173-249-18-142.sslip.io/v1/domain/headers" \
-H "X-API-Key: $SMALLAPIS_KEY" \
-H "Content-Type: application/json" \
-d '{"domain":"example.com","path":"/"}'