DevStack
Back

Security

HTTP Security Headers Analyzer

Enter a public URL. One request reads the response headers and reports Content-Security-Policy, Strict-Transport-Security, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy. Each header is marked present, worth a closer look, or missing. Private addresses are refused. The page body is discarded and the result is not stored.

Headers

Content-Security-Policy

See whether a policy is enforced, only reported, or still allows inline scripts.

HSTS

Check Strict-Transport-Security, including whether max-age covers at least six months.

Framing and content type

Look for X-Frame-Options or CSP frame-ancestors, plus X-Content-Type-Options: nosniff.

Input

Enter a public URL. One request reads the security headers the site sends.

Enter a public website. One request reads the response headers and checks Content-Security-Policy, HSTS, framing, content type, referrer, and permissions. Private addresses are refused, and the result is not stored.