ConsultationWeb
Security Headers Scanner
Inspect HTTP security headers for a domain.
Sensitive processing stays in your browser whenever possible.
Details
Headers such as CSP, HSTS, X-Content-Type-Options, and Referrer-Policy strengthen browser defenses. Their absence makes client-side exploitation easier.
The scanner will soon inspect live domain responses and show gaps with short remediation guidance. CSP must be tuned to the real app so it does not break functionality.
Coming soon
Tips
- Enable HSTS only after confirming site-wide HTTPS.
- Start CSP in report-only mode and tighten gradually.
- Headers complement server controls; they do not replace authentication and authorization.