Security Headers Checker

Fetches a URL and grades its HTTP response headers against OWASP's own security headers baseline: HSTS, Content-Security-Policy, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, X-Frame-Options, and the cross-origin trio (Cross-Origin-Opener-Policy, Cross-Origin-Resource-Policy, Cross-Origin-Embedder-Policy). Every header gets a plain-English explanation of what it actually protects against, not just present/missing — and a few common misconfigurations (a weak HSTS max-age, a CSP that still allows unsafe-inline) are called out even when the header is technically present. Requires a live network request, made server-side (a browser can't read raw cross-origin response headers itself). Nothing you check is logged or stored.

Why do these headers matter?

None of these headers make a site secure by themselves — they're defense-in-depth controls the browser enforces on your behalf, closing off entire attack classes that would otherwise rely on the browser's default (permissive) behavior. A missing Content-Security-Policy doesn't mean a site has an XSS vulnerability, but it does mean that if one is ever introduced (a single unescaped template variable, a compromised third-party script), the browser has no independent backstop to limit the damage. Grades here weight the headers with the broadest real-world impact (HSTS, CSP) higher than the newer cross-origin-isolation trio (COOP/COEP/CORP), which matters most for sites doing SharedArrayBuffer-style cross-origin work — a lower grade on those three alone isn't a red flag the way a missing CSP or HSTS is.

A note on scope

For safety, requests to localhost, private/loopback/link-local IP ranges, and non-http(s) schemes are blocked. Redirects are followed automatically (up to 20 hops) and the final response's headers are what get graded — if your site redirects HTTP to HTTPS, that's expected and correct. This tool checks headers only, not your actual CSP policy's correctness for your specific site (a CSP that's present and free of unsafe-inline can still be too permissive in ways only you know are safe or not) — see the CSP Cheat Sheet for real policy design. See also the HTTP Inspector for the full response (all headers, status, redirects, timing) and the TLS Certificate Inspector for the certificate itself.