Demo — no request is sent to any site; a previously captured result is shown
Sample result. These findings are real output from scanning example.com on 2026-09-13. Your own input was not scanned, and nothing you enter here leaves your browser.
Live access is by invitation. Verify an approved email to run this page against your own target, or ask for access.
Headers analyzed
Content-Security-Policy
Prevents XSS — key directives, unsafe-inline/eval detection
Strict-Transport-Security
HTTPS enforcement, max-age, includeSubDomains
X-Frame-Options
Clickjacking protection
X-Content-Type-Options
MIME sniffing prevention
Referrer-Policy
URL leakage control
Permissions-Policy
Camera, mic, geolocation restrictions
Cross-Origin-Embedder-Policy
Spectre/cross-origin resource isolation
Cross-Origin-Opener-Policy
Cross-origin window isolation
X-XSS-Protection
Deprecated — check for insecure values
Server header
Version disclosure detection