Security Header Checker

Security Headers: The Defense-in-Depth Layer

HTTP response headers are one of the most cost-effective security investments available. Adding a handful of headers, no code changes, no infrastructure, meaningfully reduces XSS, clickjacking, MIME-sniffing, and information-leakage risks. The browser enforces them; you just have to send them. This checker analyzes a site's current headers and grades them against modern best practices.

The Modern Header Set

Strict-Transport-Security (HSTS)

Tells browsers to always use HTTPS for this domain (and optionally subdomains) for the specified duration (max-age in seconds). After the first visit, even typing http://example.com rewrites to HTTPS in the browser, no opportunity for MITM downgrade.

• max-age=63072000 (2 years) is standard.
• includeSubDomains extends protection to all subdomains.
• preload opts in to browser-hardcoded HSTS lists (set after testing!).

Once HSTS is active and the user's visited once, MITM can't downgrade them to HTTP. Without HSTS, an attacker controlling the network can strip HTTPS from the first visit.

Content-Security-Policy (CSP)

The most powerful and most complex header. A whitelist of allowed sources for various resource types:

Directives:

• default-src, fallback for other directives.
• script-src, JavaScript sources. Most important.
• style-src, CSS sources.
• img-src, image sources.
• font-src, fonts.
• connect-src, XHR/fetch destinations.
• frame-src, iframe sources.
• frame-ancestors, who can embed THIS page in iframes (clickjacking).
• object-src, Flash/plugins (set to 'none', Flash is dead).
• base-uri, <base> tag restriction.
• form-action, where forms can submit to.
• upgrade-insecure-requests, auto-upgrade http:// to https:// in subresources.

Source expressions:

• 'self', same origin.
• 'none', nothing.
• 'unsafe-inline', inline <script> or style (avoid).
• 'unsafe-eval', eval() (avoid).
• 'nonce-{value}', specific inline element with matching nonce attribute.
• 'sha256-{hash}', specific inline content with matching hash.
• https://cdn.example.com, specific origin.
• https:, any HTTPS origin.
• *, anything (defeats the purpose).
• 'strict-dynamic', once a script is allowed via nonce/hash, scripts it loads are also allowed.

Modern best-practice CSP uses strict-dynamic with nonces:

Reasoning: nonces let you inline your bootstrap script; strict-dynamic lets that script load whatever it needs without listing every CDN.

For sites that can't fully eliminate inline scripts: start with Content-Security-Policy-Report-Only (logs violations without enforcing), gather data, tighten over time.

X-Frame-Options

Prevents this page from being embedded in an iframe (clickjacking defense). Options:

• DENY, never allow framing.
• SAMEORIGIN, only same-origin frames.
• ALLOW-FROM uri, specific origin (deprecated; use CSP frame-ancestors).

For modern sites, prefer CSP frame-ancestors:

But also set X-Frame-Options as legacy fallback.

X-Content-Type-Options

Prevents browsers from MIME-sniffing, guessing a file's type when the Content-Type header is wrong. Without nosniff, a user-uploaded "image" that's actually HTML/JS might be executed. Set on every response.

Referrer-Policy

Controls the Referer header sent to other sites. Default behavior leaks the full URL (including paths and query strings, privacy risk).

Common values:

• no-referrer, never send Referer.
• same-origin, send full URL only same-origin, nothing cross-origin.
• strict-origin, send origin only (no path), cross-origin only if HTTPS→HTTPS.
• strict-origin-when-cross-origin (the modern default in browsers), full URL same-origin, origin cross-origin, none if HTTPS→HTTP.

Permissions-Policy

Disables browser features (or restricts to certain origins). Especially important for:

• camera, microphone, geolocation, disable if you don't use them.
• interest-cohort, opts out of FLoC/Topics tracking.
• browsing-topics, same as above for newer name.
• payment, usb, bluetooth, midi, disable if not used.
• fullscreen, picture-in-picture, usually fine to allow.

Cross-Origin Headers (COOP, COEP, CORP)

Newer headers for browser isolation:

• Cross-Origin-Opener-Policy: same-origin, prevents cross-origin window references.
• Cross-Origin-Embedder-Policy: require-corp, requires explicit opt-in for cross-origin resources.
• Cross-Origin-Resource-Policy: same-origin, limits which origins can load this resource.

Required for SharedArrayBuffer access (and high-resolution timers, important for crypto and performance work).

Deprecated Headers (Don't Use)

• X-XSS-Protection: legacy IE/Chrome XSS filter, removed from modern browsers. Some old guides still recommend; ignore.
• Public-Key-Pins (HPKP): HTTP Public Key Pinning. Removed by Chrome in 2018 due to lockout risk.
• Expect-CT: Certificate Transparency expectation; now always-required, no need to opt in.
• X-Webkit-CSP / X-Content-Security-Policy: prefixes for old browsers; current name Content-Security-Policy works everywhere.

Sending deprecated headers wastes bandwidth and signals stale config. Remove them.

Minimum Header Set for a Typical Site

For a static or simple dynamic site:

Add to your server config (nginx, Apache, Express middleware) or your CDN's response-headers feature (Cloudflare Pages _headers, Netlify, Vercel).

For a tighter CSP: replace 'unsafe-inline' with nonces, and replace explicit script-src 'self' with script-src 'nonce-{random}' 'strict-dynamic'.

Testing Your Headers

This tool checks a site's current headers and grades them. Other useful tools:

• securityheaders.com by Scott Helme, the canonical online checker.
• Mozilla Observatory, broader site security audit including TLS.
• CSP Evaluator by Google, analyzes a CSP for common weaknesses.
• Browser DevTools, Network tab shows received headers.

After adding headers, also test that the site actually works, too-strict CSP breaks JavaScript, too-strict CORS breaks cross-origin requests. Use Report-Only mode first.

Common Mistakes

HSTS preload without testing. Once on the preload list, removal is slow. Test with short max-age first.

CSP with unsafe-inline "to ship faster". Defeats the point. Use nonces.

Wildcard sources in CSP (script-src *). Defeats the whitelist.

Forgetting frame-ancestors / X-Frame-Options. Sites without these can be iframed for clickjacking.

Setting X-Frame-Options: SAMEORIGIN when site never needs framing. Use DENY instead, tighter.

Inconsistent headers across pages. Set in middleware/edge so all responses get them.

Setting headers on HTML but not on assets. JavaScript files should also have X-Content-Type-Options: nosniff at minimum.

max-age=0 HSTS. Disables HSTS. Common during testing; remember to remove.

Privacy

This checker runs entirely in your browser. When you paste headers: parsing is local. When you fetch a URL: the request goes from your browser directly to the target; no intermediate logging server. Open DevTools Network during use: you'll see only the target site's request. Important because URLs being audited sometimes reveal internal infrastructure (staging.internal.company.com, auth-canary.example.com) that shouldn't appear in third-party logs, they stay in your browser only.