HTTP Security Header Checker

HTTP security headers activate browser defenses that ordinary application code cannot replace. They can pin future requests to HTTPS, restrict script and resource loading, prevent unauthorized framing, disable MIME sniffing, limit referrer data and powerful browser features, and isolate pages from untrusted cross-origin windows.

This checker audits seven common controls from a raw response-header block: Strict-Transport-Security, Content-Security-Policy, X-Frame-Options or CSP frame-ancestors, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, and Cross-Origin-Opener-Policy. It distinguishes a missing header from a weak value, such as a short HSTS max-age, CSP unsafe-inline or unsafe-eval, an ineffective X-Content-Type-Options value, or a non-isolating COOP policy.

The tool does not fetch your site. Parsing and auditing happen entirely in the browser, so you can safely paste headers copied from developer tools, curl, a private staging environment, or an internal application. Treat the findings as a focused baseline and test policy changes against your application before deploying them broadly.