SecurityHeaders.com alternative: headers plus the rest of your surface

SecurityHeaders.com is one of the good ones. Scott Helme built it in 2015, it grades your HTTP response headers A+ to F, and for a decade it's been the fastest way to sanity-check whether you set Strict-Transport-Security and Content-Security-Policy correctly. It's now a Snyk project, the free web scanner is live and well maintained, and if a manual header grade is all you want, keep using it. This isn't a "it's dying, switch" pitch.

The honest question is narrower: a header grade tells you about your headers, and nothing about the rest of what your site serves the public. If you came here looking for an alternative, it's usually because one grade for one band stopped being enough, not because the tool let you down.

(One footnote if you're here for the paid API rather than the web tool: that part was discontinued. The API page now reads "This service has been discontinued. We are no longer providing new subscriptions or renewing existing subscriptions." The free web scanner is unaffected. If you had that API wired into CI to track header drift, you need somewhere else to point it, and a report that watches the whole surface on a schedule is a better home for that job than another header-only endpoint.)

So the real question isn't "what's another header grader." It's "what gives me header grading plus the parts of my surface SecurityHeaders.com was never built to check?"

What SecurityHeaders.com checks, and what it doesn't

It's a single-URL header grader, and an honest one. It reads your response headers and grades the security-relevant ones: HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, plus your Set-Cookie flags and any information-leaking headers like Server or X-Powered-By. HSTS and CSP carry the most weight. For that job it's excellent and it's the reference standard.

What it does not do, because it was never meant to: it doesn't analyze your TLS certificate or cipher suites (that's Qualys SSL Labs), it doesn't check DNS or email authentication like SPF and DMARC, it doesn't look for secrets in your JavaScript or a reachable /.env, it doesn't scan for exposed admin panels or vulnerable libraries, and in the free web tool it doesn't monitor on a schedule or alert you. It grades one page's headers, once, when you ask.

A focused tool that does one thing well is worth having, and SecurityHeaders.com is exactly that. It just means your headers are one band of a much wider surface, and a header grade tells you nothing about the other bands.

The gap a single-purpose grader leaves

Here's the part worth seeing rather than reading. Mozilla's HTTP Observatory covers headers and adds cookies, CORS, and SRI. SSL Labs covers TLS and nothing else. SecurityHeaders.com covers headers. Each is deep in its lane and blind to the others, and none of them watches the things that actually leak credentials.

	SSL Labs	SecurityHeaders	Observatory	One report
TLS / certificate
Security headers
Cookies, CORS, SRI
Secrets in JS bundle
Exposed .env, .git
SPF, DMARC, CAA
Subdomain takeover

To cover your real external surface with these tools you'd run three of them, in three tabs, on no schedule, and still miss secrets, exposed files, and DNS. The header grade is genuinely useful, and it's still one tab of three that between them leave the leak-grade rows uncovered.

What to use instead

If headers are genuinely all you care about, keep using SecurityHeaders.com or Observatory by hand. They're free and they're good. No notes.

If you want the header grade and the rest of what an attacker reads off your site, in one graded report you can re-run on a schedule, that's the gap SurfaceCheckr fills. We grade the same headers (HSTS, CSP, X-Frame-Options, cookie flags, the information-leaking ones) and roll them together with TLS, CORS, SRI, secrets in your JavaScript, exposed files, and SPF/DMARC/CAA into one A-to-F result, then re-scan it so header drift and a newly leaked key both show up the same day. We're not claiming to out-grade Scott Helme's tool at headers; it's the standard and we measure against it. We're saying headers are one row of seven, and a single report that watches all seven is the move. You can run it on your domain right now and see every row at once.