Security Headers Checker
Review the browser security headers returned by a public page.
Inspect HTTP security headers
The audit checks the presence of CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy and Permissions-Policy.
Interpret the result
The coverage summary shows which common browser protections are declared and which header names are absent.
Catch common problems
Missing headers can leave avoidable browser attack surface, while an overly strict CSP or HSTS rollout can also break legitimate resources or subdomains.
How to interpret HTTP security headers
Presence is not the same as a secure value; this tool does not validate policy syntax, effective directives, TLS quality, application vulnerabilities, or exploitability.
Common problems and next steps
Missing headers can leave avoidable browser attack surface, while an overly strict CSP or HSTS rollout can also break legitimate resources or subdomains.
Frequently asked questions
What does the HTTP security headers check cover?
The audit checks the presence of CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy and Permissions-Policy.
How should I use the result?
Review missing controls against the application’s threat model, deploy policies gradually, and test actual browser behavior after configuration changes.
What are the limits of this tool?
Presence is not the same as a secure value; this tool does not validate policy syntax, effective directives, TLS quality, application vulnerabilities, or exploitability.