Home / Security Tools / Security Headers
Security Tools
HSTS, CSP, referrer and frame policy audit.
Security Headers audits the HTTP response headers returned by a URL, checking for the presence and correct configuration of HSTS, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options and Referrer-Policy.
Enter a full URL (https://example.org) and run the tool. The probe fetches the URL and inspects every security-relevant response header.
Input: URL — e.g. https://example.org.
Each header is listed with a status of PASS, WARN or MISSING and a short explanation. HSTS forces HTTPS, CSP prevents cross-site injection, X-Frame-Options prevents clickjacking, and X-Content-Type-Options prevents MIME sniffing. Missing headers expand your attack surface; the summary grade reflects overall posture.
→ Audit a site’s security headers before launch.
→ Find missing HSTS, CSP or framing protections.
→ Verify header configuration after a CDN or server change.
→ Produce a header posture report for a compliance review.
Strict-Transport-Security tells browsers to always use HTTPS for your site for a given max-age, preventing SSL-stripping downgrade attacks. Include includeSubDomains and preload once you are confident all subdomains serve HTTPS, then submit to the HSTS preload list.
Yes — CSP is one of the strongest defences against XSS and injection. Start with report-only mode to see violations without breaking anything, then tighten. Even a restrictive default-src policy dramatically reduces injection risk.
CSP frame-ancestors supersedes X-Frame-Options in modern browsers, but keep X-Frame-Options: DENY/SAMEORIGIN for older clients that do not support CSP. They are complementary, not mutually exclusive.