- Input
https://example.com/- Result
X-Content-Type-Options: nosniff → Present
Evaluate header values, not just their presence. A report-only CSP reports violations without blocking them; HSTS needs HTTPS and a positive max-age.
Security headers check: inspect HTTP responses
Inspect a page’s CSP, HSTS and other HTTP response headers. Read actual values and contextual explanations; this check does not certify website security.
Result
We count which tools are used most, without including entered values or file contents in the statistics. Privacy
How to use the tool
Enter a public URL. Read the final response headers and redirect chain.
How the check works
The check follows permitted redirects and reads headers from the final response. It displays received values without enforcing the website policy in a browser.
Interpreting the result
Evaluate header values, not just their presence. A report-only CSP reports violations without blocking them; HSTS needs HTTPS and a positive max-age.
Illustrative example
Illustrative example with sample data: actual responses may change.
Limits and data handling
An existing header does not certify security. Evaluate CSP against site resources; frame-ancestors may replace X-Frame-Options. Only the observed response and up to four hops are checked.
Your input is sent to the server for inspection. No authentication is sent to the destination site.
Results reflect the time of the check.
Sources
Frequently asked questions
What are the limits of this check?
An existing header does not certify security. Evaluate CSP against site resources; frame-ancestors may replace X-Frame-Options. Only the observed response and up to four hops are checked. Results reflect the time of the check.