Security Headers Analyzer

CSP · HSTS · X-Frame-Options · COEP · COOP · Referrer-Policy · Permissions-Policy

Domain

HEAD request sent server-side — target site only sees a single request from our IP

Headers analyzed

25pts

Content-Security-Policy

Prevents XSS — key directives, unsafe-inline/eval detection

10pts

Strict-Transport-Security

HTTPS enforcement, max-age, includeSubDomains

5pts

X-Frame-Options

Clickjacking protection

5pts

X-Content-Type-Options

MIME sniffing prevention

5pts

Referrer-Policy

URL leakage control

5pts

Permissions-Policy

Camera, mic, geolocation restrictions

5pts

Cross-Origin-Embedder-Policy

Spectre/cross-origin resource isolation

5pts

Cross-Origin-Opener-Policy

Cross-origin window isolation

info

X-XSS-Protection

Deprecated — check for insecure values

5pts

Server header

Version disclosure detection