Examples:

Enter a URL to check its HTTP security headers.

HTTP Security Headers

Analyze security headers (HSTS, CSP, X-Frame-Options, etc.) for any URL using a public CORS proxy. Grades and recommendations included.

Common uses

  • Check which security headers a site is missing
  • Verify that HSTS is enabled on a domain

Frequently asked questions

Is my data uploaded to a server?

Partially — see the note above. In "Fetch URL" mode, the URL you enter is relayed through public CORS proxies to read its response headers. Switch to "Paste Headers" mode to keep everything local.