Security Headers Checker
Review the browser security headers returned by a public page.
Inspect HTTP security headers
The audit checks the presence of CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy and Permissions-Policy.
Interpret the result
The coverage summary shows which common browser protections are declared and which header names are absent.
Catch common problems
Missing headers can leave avoidable browser attack surface, while an overly strict CSP or HSTS rollout can also break legitimate resources or subdomains.
How to interpret HTTP security headers
The coverage summary shows which common browser protections are declared and which header names are absent. Presence is not the same as a secure value; this tool does not validate policy syntax, effective directives, TLS quality, application vulnerabilities, or exploitability.
What the tool evaluates
The audit checks the presence of CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy and Permissions-Policy. The coverage summary shows which common browser protections are declared and which header names are absent.
- The audit checks the presence of CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy and Permissions-Policy.
- Missing headers can leave avoidable browser attack surface, while an overly strict CSP or HSTS rollout can also break legitimate resources or subdomains.
- Review missing controls against the application’s threat model, deploy policies gradually, and test actual browser behavior after configuration changes.
Common problems and next steps
Missing headers can leave avoidable browser attack surface, while an overly strict CSP or HSTS rollout can also break legitimate resources or subdomains. Review missing controls against the application’s threat model, deploy policies gradually, and test actual browser behavior after configuration changes. Presence is not the same as a secure value; this tool does not validate policy syntax, effective directives, TLS quality, application vulnerabilities, or exploitability.
Frequently asked questions
What does the HTTP security headers check cover?
The audit checks the presence of CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy and Permissions-Policy.
How should I use the result?
The coverage summary shows which common browser protections are declared and which header names are absent. Review missing controls against the application’s threat model, deploy policies gradually, and test actual browser behavior after configuration changes.
What are the limits of this tool?
Presence is not the same as a secure value; this tool does not validate policy syntax, effective directives, TLS quality, application vulnerabilities, or exploitability.