About the HTTP Security Headers
The HTTP security headers checker reviews browser-facing response headers and highlights protections that are present, missing, or potentially weak. It provides an actionable starting point for hardening a public web response.
How to use this tool
Enter the exact HTTPS URL to inspect. Check representative HTML pages rather than assuming one route's policy applies everywhere, and include error or authentication pages when they use different infrastructure. Read each finding in the context of the application before copying a recommended value. Content Security Policy and cross-origin isolation headers in particular require testing because an overly strict deployment can block legitimate scripts, frames, downloads, or integrations.
How to read the result
HSTS tells browsers to prefer HTTPS for future requests. Content-Security-Policy restricts resource sources and other browser capabilities. X-Content-Type-Options reduces MIME sniffing, while frame-ancestors or X-Frame-Options controls embedding. Referrer-Policy limits referrer information, Permissions-Policy controls selected browser features, and COOP, COEP, or CORP influence cross-origin isolation. A present header can still be ineffective if its directive or scope is unsuitable.
Limits and privacy
Header review is not a vulnerability scan and cannot assess application code, dependencies, authentication, cookies, server patching, or whether a policy breaks real user flows. The server-side request can receive a different response from authenticated browsers or other regions. Recommendations are general and require application-specific validation. Public URLs are submitted to buffer.lol; resolved private and reserved targets are blocked.
Common questions
- Will adding every recommended header make a site secure?
- No. Headers are one layer of browser hardening. Secure code, authentication, dependency management, infrastructure, and testing are still required.
- Why must Content Security Policy be tested first?
- A policy can block required scripts, styles, connections, frames, or workers. Report-only deployment and browser testing help identify needed sources safely.