URL-first security headers check

Review HTTP response headers before you publish

Enter a public URL to fetch response headers, or paste them from browser developer tools to review CSP, HSTS, clickjacking protection, and Cross-Origin headers. URL mode uses the bounded Web-Tool route.

Check a URL or response headers

Inspection result

Plain-text report

This is an automated assistive check of headers. It does not guarantee security, OWASP/WCAG conformance, browser compatibility, or resistance to real attacks. Check certificates, all subdomains, and third-party resources before changing CSP or HSTS.

What it checks

CSP default-src, object-src, frame-ancestors, and unsafe-inline/eval.
HSTS max-age, includeSubDomains, and preload. Longer policies and broad scope need staged verification.
The values of X-Content-Type-Options, Referrer-Policy, and X-Frame-Options.
COOP, COEP, CORP, and Permissions-Policy syntax and cross-origin compatibility notes.
Duplicate headers, malformed lines, and disclosure through Server or X-Powered-By.

References

OWASP HTTP Headers Cheat Sheet / MDN Content-Security-Policy / MDN Strict-Transport-Security