Enter a URL to scan HTTP response headers, security headers (HSTS, CSP, X-Frame-Options, etc.), and cookie flags. The scan runs server-side to avoid CORS. No data is stored.