Security Headers
Grade your HTTP response headers.
Typical useKnow your website's security-header grade and get told when a deploy quietly makes it worse.
Grade a site's HTTP response headers against current best practice — CSP, HSTS, frame and content-type protections — and get told when the grade regresses.
Free to start on every tool — no card, no time limit. You pay only for what grows beyond the free tier. Sign in with your qzila account to use it.
What it checks
- Content-Security-Policy quality, not just presence
- Strict-Transport-Security, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy
- A letter grade with the exact header to add or fix
- Scheduled re-checks; alerts on regressions
How this tool bills
Indicative prices, EUR excl. VAT. The current price list is in your account and applies from the day you add something.
Pricing examples
Three typical situations, worked through the way the invoice would show them. Prices are indicative; the current price list is in your account.
- Example 1 · Trying it out2 URL watcheds
A freelancer or a small company signs in and adds 2 URL watcheds to see what the tool finds.
Everything you add is within the free tier (2 URL watcheds free every month), so nothing is billed. There is no time limit — it stays free while you stay within it.
2 − 2 free = 0 × €1.50Monthly bill: €0.00 — free. - Example 2 · A small company6 URL watcheds
A company adds 6 URL watcheds — its main systems and a couple it acquired along the way.
The first 2 are covered by the free tier. The remaining 4 are billed at €1.50 each, metered per month.
6 − 2 free = 4 × €1.50Monthly bill: 4 × €1.50 = €6.00/ month. - Example 3 · An agency or a larger estate20 URL watcheds
An MSP, an auditor or a larger company watches 20 URL watcheds across several clients or business units.
The free tier still covers the first 2. The other 18 are billed at €1.50 each. Remove something mid-month and it stops counting the same day; set a budget and you are warned before you reach it.
20 − 2 free = 18 × €1.50Monthly bill: 18 × €1.50 = €27.00/ month, itemised on one invoice.
Try your own numbers
The API
Every qzila tool is a GraphQL API first; the web UI is one client of it. Anything you can do in the browser you can do from a script, a CI job or the Asign platform.
https://securityheaders.tools.qzila.com/graphqlPOST · application/json · { "query": "…" }
Requests are authenticated with your qzila session (the same sign-in as the browser). For automation, sign in once at identity.qzila.com and reuse the session cookie; API keys for service accounts are on the roadmap.
Whatever this tool detects — a verdict flip, a regression, a change, an incident — is emitted as a signal to the qzila alert hub, which forwards it to email, Slack, a webhook, SMS or Jira, and to ServiceWatch. Each signal carries the asset it belongs to, so you can correlate it back to your own inventory (or to an Asign asset).
Main operations
scanmutationScan a URL and get the graded report with every header and its finding.
mutation { scan(url: "https://example.com") { grade headers { name present grade advice } } }sessionHistoryqueryYour scans, newest first, with their grades.
query { sessionHistory { url grade scannedAt } }reportqueryThe stored report for one of your scans, by canonical URL.
query { report(url: "https://example.com") { grade headers { name advice } } }
Send requests to https://securityheaders.tools.qzila.com/graphql
Questions about Security Headers
Which headers are graded?
Strict-Transport-Security, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy and the cross-origin isolation headers, plus leaks such as Server and X-Powered-By.
What do the grades mean?
A+ to F, the same scale auditors and security scanners use. Each finding says which header is missing or misconfigured and gives the value to set.
Does it re-check automatically?
Yes. A watched URL is re-scanned daily and you are alerted when the grade drops — typically after a deploy or a CDN change.
Will a Content-Security-Policy break my site?
It can, which is why the report suggests a report-only policy first. Roll it out in report-only mode, fix what it reports, then enforce.
Is the free tier a trial?
No. It stays free for as long as you stay within it — no card, no time limit. You only start paying when you add more than the free tier covers.
How am I billed?
Monthly, for what you actually had in the tool during the month, at the public price per unit. Everything lands on one invoice itemised per tool. Remove something and it stops billing the same day.
Where do alerts go?
Every tool reports through one alert hub. You choose per destination: email, Slack, a webhook, SMS or a Jira ticket — and ServiceWatch shows the same signals on one board.
Where is my data kept?
In the European Union. qzila is built and operated by adcore s.r.o., a Slovak company; the tools run on EU infrastructure.
Start with one tool. Add the rest when you need them.
Sign in once and every tool is a click away. You pay only for what you watch, per month, with no minimum and no contract — the price list is in your account before you add anything.
- One account across every qzila tool
- Free tier on every tool, then pay-as-you-go
- Alerts to email, Slack, webhook, SMS or Jira