Web

Security Headers Scanner

Inspect HTTP security headers for a domain.

Sensitive processing stays in your browser whenever possible.

Details

Headers such as CSP, HSTS, X-Content-Type-Options, and Referrer-Policy strengthen browser defenses. Their absence makes client-side exploitation easier.

This scanner inspects live domain responses and shows gaps with short remediation guidance. CSP must be tuned to the real app so it does not break functionality.

Domain / host

Tips

Enable HSTS only after confirming site-wide HTTPS.
Start CSP in report-only mode and tighten gradually.
Headers complement server controls; they do not replace authentication and authorization.

FAQ

Headers?+

Baseline CSP, HSTS, and similar.

Replace pentest?+

No.

Internet check?+

Do not expose internal paths.

Next?+

Web hardening consult.