Security Headers Auditor

Audit HTTP security response headers

Modern browsers enforce policies sent in HTTP response headers: Content-Security-Policy against XSS, Strict-Transport-Security for HTTPS, framing controls against clickjacking, and Permissions-Policy for powerful APIs. Paste raw response headers from curl, DevTools, or log files to see which defenses are present.

Headers this auditor checks

• Content-Security-Policy, looks for default-src and flags unsafe-inline/eval.
• Strict-Transport-Security, validates max-age (1 year minimum for strong HSTS).
• Framing, X-Frame-Options or CSP frame-ancestors.
• X-Content-Type-Options, expects nosniff.
• Referrer-Policy and Permissions-Policy.

For Chromium preload eligibility on HSTS alone, try the HSTS Preload Checker.