Security · Instant result
Security Headers
Audit the HTTP response headers that harden browsers against XSS, clickjacking and mixed content.
What it’s for
Quick hardening checklist for production sites — especially after launching a new stack or CDN.
How it works
We fetch the URL (following a few redirects) and look for HSTS, CSP, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy and related headers.
What you get
A scored checklist: what is present, what is missing, and a short hint for each gap.
We look at
- HSTS
- CSP
- X-Content-Type-Options
- X-Frame-Options
- Referrer-Policy
- Permissions-Policy
How to use
- 1 Paste the live page URL (prefer https).
- 2 Fix critical missing headers first (HSTS, CSP).
- 3 Re-run after deploying config changes.