Bulk Security Header Checker

Scan HTTP security headers across up to 25 URLs in one batch. HSTS, CSP, X-Frame-Options, Permissions-Policy — graded A+ to F.

Security headers are easy to misconfigure across a portfolio. One tenant ships without HSTS, one storefront strips CSP from a CDN rule, one staging site got promoted to prod with default headers. Bulk header checks catch all of that in one paste.

## What this tool does

Paste up to 25 URLs. We fetch each one, read the HTTP response headers (without rendering the page), and compute a per-URL grade based on the same checklist as the single-URL Security Header Checker. The result is a table of grades you can sort and export.

## What we look for

Strict-Transport-Security (HSTS) — forces HTTPS. Content-Security-Policy (CSP) — the biggest single defence against XSS. X-Frame-Options / frame-ancestors — prevents clickjacking. X-Content-Type-Options: nosniff — kills MIME confusion attacks. Referrer-Policy — limits data leakage in the Referer header. Permissions-Policy — locks down browser APIs the site does not need. Each missing or weak header costs points; the grade comes out the other side.

## Why this matters at scale

Single-URL header checks are great for one site. Multi-tenant SaaS, agency portfolios, and ecommerce platforms with multiple storefronts need fleet-wide visibility — and that visibility cannot be 'log into each site individually'. Bulk header checks turn the audit into one paste.

What this tool checks

• Strict-Transport-Security (HSTS) presence and max-age
• Content-Security-Policy presence and major directives
• X-Frame-Options / frame-ancestors
• X-Content-Type-Options
• Referrer-Policy and Permissions-Policy
• Per-URL composite grade

Why it matters

Security headers are quiet but critical — missing ones leave sites open to clickjacking, XSS injection, and downgrade attacks. Across a multi-site portfolio, headers drift silently as new pages and tenants ship.

How to fix what it finds

• Group the CSV by missing header and ship one platform-level fix (HSTS at the edge, CSP at the CDN)
• Start with HSTS — it is one line and prevents 90% of downgrade attacks
• Add CSP in report-only mode first; review violations for 2 weeks before enforcing
• Use the single-URL Security Header Checker on the lowest-graded row to get example header values

Methodology

We send a single GET request to each URL with a normal browser User-Agent and follow up to 5 redirects. We read the final response headers and run them through the same scoring matrix as the single-URL tool: HSTS presence + max-age + includeSubDomains + preload, CSP presence + key directive coverage, X-Frame-Options or frame-ancestors, X-Content-Type-Options, Referrer-Policy strictness, and Permissions-Policy. We do not parse or execute the HTML — headers only. The grade is computed deterministically: each header carries a weight, and the composite weighted score maps to A+/A/B/C/D/F bands. Rows are returned in the order you submitted them so you can match against your source list.

Frequently asked questions

Why does the grade differ from another scanner?

Different scanners weight headers differently. We follow the same rubric as the single-URL Security Header Checker on this site for consistency.

Does this check the body of the page?

No. We only read HTTP response headers. CSP nonces, inline-script policies, and other body-level concerns need the single-URL deep dive.

How many redirects will it follow?

Up to 5. URLs with redirect loops will fail with a redirect-loop error.

Will this trigger rate limits on my sites?

Unlikely — we issue one GET per URL with a 1-second delay between batch starts. If your WAF blocks unknown user-agents, allowlist requests from LemWatch.

Can I check internal/staging URLs?

Only if they are reachable from the public internet. URLs behind a VPN or auth wall will return errors.

What does the CSV include?

URL, status, grade summary, and any error message. Click into the row to see all individual header values in the single-URL tool.