Security
HTTP Security Headers Analyzer
Enter a public URL. One request reads the response headers and reports Content-Security-Policy, Strict-Transport-Security, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy. Each header is marked present, worth a closer look, or missing. Private addresses are refused. The page body is discarded and the result is not stored.
Score
85%
Type
Lookup
Core features
Content-Security-Policy
See whether a policy is enforced, only reported, or still allows inline scripts.
HSTS
Check Strict-Transport-Security, including whether max-age covers at least six months.
Framing and content type
Look for X-Frame-Options or CSP frame-ancestors, plus X-Content-Type-Options: nosniff.
Specifications
| Headers | CSP, HSTS, frame, nosniff, referrer, permissions |
|---|---|
| Request | One GET, body discarded |
| Grades | Present, review, missing |
| Privacy | Not stored |