Resources

Security headers checker

Paste a public URL. The same free check opens that page and lists which of the usual security headers are missing. It does not grade how strict the policy is, and it does not crawl the rest of the site.

What this check looks at

• Strict-Transport-Security, when the final URL is HTTPS.
• Content-Security-Policy.
• X-Content-Type-Options set to nosniff.
• X-Frame-Options, or a Content-Security-Policy frame-ancestors directive.
• Referrer-Policy.
• Permissions-Policy.

What it does not do

• One page, the URL you paste. Not a scan of every route.
• It notices when a header is absent. It does not tell you if a Content-Security-Policy is strict, loose, or wrong for your app.
• It does not click, sign in, or submit a form. The result page also includes the rest of a free check: load, console errors, broken images and same-site links, a few obvious tokens, and the /.env and /.git probes.