Security
HTTP Security Headers Analyzer
Enter a public URL. One request reads the response headers and reports Content-Security-Policy, Strict-Transport-Security, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy. Each header is marked present, worth a closer look, or missing. Private addresses are refused. The page body is discarded and the result is not stored.
Quick start
- 1
Enter the URL
Use a public http or https address you are allowed to request. Private and local addresses are refused.
- 2
Check headers
One GET is sent. The page body is discarded.
- 3
Read each grade
Present means the header is there and looks usable. Review means it is present but weak or report-only. Missing means the response did not include it.
- 4
Export
Copy the notes or download JSON. The result is not stored.
Features
Content-Security-Policy
See whether a policy is enforced, only reported, or still allows inline scripts.
HSTS
Check Strict-Transport-Security, including whether max-age covers at least six months.
Framing and content type
Look for X-Frame-Options or CSP frame-ancestors, plus X-Content-Type-Options: nosniff.
Specifications
- Headers
- CSP, HSTS, frame, nosniff, referrer, permissions
- Request
- One GET, body discarded
- Grades
- Present, review, missing
- Privacy
- Not stored
Use cases
- See whether a site sends Content-Security-Policy and HSTS.
- Check framing and content-type headers before a release.
- Compare a staging URL with production.
Frequently asked questions
Does a missing header mean the site is vulnerable?
No. It means that particular browser instruction was not in the response. The check does not try to attack the page.
Which headers are checked?
Content-Security-Policy, Strict-Transport-Security, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy.