Audit HTTP security headers

Check HTTP response headers for browser security protections and weak directives.

freeworks offlinenothing uploaded
ToolSecurity Headers Check
Input
Output
—
Put this on your own site

The frame below runs the same code as this page, in the reader's own browser. Nothing is sent to us, and nothing is sent to you.

Pick a dark background and the text and panels follow it, so the frame stays readable on a dark page.

Preview

How it works

Captured headers are compared with transport, sniffing, framing, referrer, permissions, and content-security checks; findings identify missing, weak, or conflicting directives. The checker evaluates headers and does not change a server.

  • Browser-enforced protections provide broad value.
  • CSP and Permissions-Policy remain application-specific.

Worked example

Audit four common security headers
Analyze HTTP headers including HSTS, CSP, X-Content-Type-Options, and X-Frame-Options
Input
											Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
X-Frame-Options: DENY
Content-Security-Policy: default-src 'self'
Output
												Security Headers Analysis
Score: 55/100 (Grade: D)
Present: 4/11

Details:
  [+] content-security-policy: default-src 'self'
      PRESENT - Prevents XSS and data injection attacks
  [+] strict-transport-security: max-age=31536000
      PRESENT - Forces HTTPS connections
  [+] x-content-type-options: nosniff
      PRESENT - Prevents MIME type sniffing
  [+] x-frame-options: DENY
      PRESENT - Prevents clickjacking
  [-] x-xss-protection
      MISSING (optional) - Legacy XSS filter (deprecated)
  [-] referrer-policy
      MISSING (recommended) - Controls referrer information
  [-] permissions-policy
      MISSING (recommended) - Controls browser features
  [-] cross-origin-opener-policy…

When to use this

Production audits, preview CI, and penetration-test reviews check security headers.

Edge cases

  • A CSP with unsafe-inline or broad wildcards can be ineffective.
  • HSTS on an HTTP-only host can make it unreachable after caching.
  • X-Frame-Options and frame-ancestors can disagree.

References