Free HTTP security header checker.
Inspect whether a public website returns recommended HTTP security headers such as HSTS, CSP, X-Frame-Options, and Cross-Origin policies.
About HTTP security headers
Correctly configured HTTP security headers add a layer of protection against common attacks on your site. The main headers to review are HTTP Strict Transport Security (HSTS), which enforces HTTPS; Content Security Policy (CSP), which constrains page resources to help prevent XSS; X-Content-Type-Options, which prevents MIME sniffing; and X-Frame-Options, which helps protect users from clickjacking.
This checker probes the target URL and reports whether each recommended header is present, based on the live response returned by the HTTP security fingerprinting provider.
Use cases
- Review a site's defensive posture before onboarding, acquisition diligence, or pentesting.
- Spot missing HSTS, CSP, framing, and MIME-sniffing protections on public applications.
- Compare Cross-Origin isolation headers (COOP / CORP / COEP) across environments.
- Keep lightweight evidence through the downloadable raw JSON response.
Headers checked
Content Security Policy
Content-Security-Policy (CSP) tells browsers which sources are allowed to load scripts, styles, images, frames, and other resources on a page.
MDN: Content-Security-PolicyStrict Transport Policy
Strict-Transport-Security (HSTS) instructs browsers to only communicate with the host over HTTPS for a defined period.
MDN: Strict-Transport-SecurityX-Content-Type-Options
X-Content-Type-Options: nosniff stops browsers from MIME-sniffing a response away from the declared Content-Type.
MDN: X-Content-Type-OptionsX-Frame-Options
X-Frame-Options controls whether a browser may render the page inside a frame, iframe, embed, or object.
MDN: X-Frame-OptionsX-XSS-Protection
X-XSS-Protection was a legacy browser XSS filter header. Modern browsers largely ignore it in favor of CSP.
MDN: X-XSS-ProtectionReferrer Policy
Referrer-Policy controls how much referrer information is sent when navigating or loading resources.
MDN: Referrer-PolicyPermissions Policy
Permissions-Policy (formerly Feature-Policy) enables or disables browser features such as camera, geolocation, and payment APIs.
MDN: Permissions-PolicyCross-Origin-Opener-Policy
Cross-Origin-Opener-Policy (COOP) isolates a browsing context from cross-origin documents that open it.
MDN: Cross-Origin-Opener-PolicyCross-Origin-Resource-Policy
Cross-Origin-Resource-Policy (CORP) tells browsers whether other origins may load this resource.
MDN: Cross-Origin-Resource-PolicyCross-Origin-Embedder-Policy
Cross-Origin-Embedder-Policy (COEP) requires cross-origin resources to explicitly opt in before they can be embedded.
MDN: Cross-Origin-Embedder-Policy