Headers check

Paste a _headers file or the headers from an HTTP response. The page parses it in your browser and reports each rule below as pass, warn or fail. Nothing is sent anywhere.

Check some headers

The rules

• Content-Security-Policy is setA CSP limits where scripts and other resources may load from, which blunts injected-script attacks.
• CSP has no wildcard default-src or script-srcA bare * in the script source list allows scripts from anywhere, which defeats the policy.
• CSP does not allow unsafe-evalunsafe-eval lets strings run as code, a common step in turning an injection into execution.
• Framing is restrictedframe-ancestors or X-Frame-Options stops other sites embedding the page to trick clicks.
• X-Content-Type-Options is nosniffIt stops browsers guessing a file type and running, say, an uploaded text file as a script.
• Referrer-Policy is setIt controls how much of the page address is sent to other sites when a link is followed.
• Strict-Transport-Security has max-age of 15552000 or moreIt tells browsers to use HTTPS only, for at least 180 days, so a downgrade attack has less room.
• Permissions-Policy is setIt switches off browser features the page never uses, such as camera or geolocation.
• HTML responses carry Cache-ControlWithout it, caches guess how long a page stays fresh, so fixes can reach readers late.

This is a linter for common issues, not a security audit. It reads the text you paste, not a live server. It cannot see headers a CDN adds, whether a CSP breaks your pages, or any fault outside headers. A clean result means these nine checks passed, nothing more.