Security Headers Analyzer
Locally audit HTTP response headers for defensive security posture, missing hardening controls, and misconfigurations.
Paste Response Headers
Audit Report & Summary
-- Grade
Analyzing...
Header Breakdown Checklist
| Header Name | Status | Recommended Value / Purpose |
|---|
Core Defense Headers Reference
- Strict-Transport-Security (HSTS): Enforces secure (HTTPS) connections to the server, protecting against protocol downgrade attacks.
- Content-Security-Policy (CSP): Prevents XSS and data injection attacks by restricting resource domains.
- X-Content-Type-Options: Stops browsers from MIME-sniffing away from the declared content-type.