Security Headers Analyzer
Review browser-facing security response headers so you can identify missing, conflicting, or overly broad directives before changing server, CDN, or proxy configuration.
What this tool checks
CSP and HSTS
Reviews Content Security Policy and HTTP Strict Transport Security headers so you can see whether the live response includes the controls you expect. Treat a missing or restrictive directive as a configuration finding, then verify it against how the site loads resources and serves secure traffic before making changes.
Framing and Cross-Origin Controls
Checks X-Frame-Options and related cross-origin response policies that influence framing and browser isolation behavior. Use the findings to identify unexpected gaps or conflicts, then confirm the intended embedding and resource-sharing behavior before tightening a policy.
Content-Type and Referrer Controls
Reviews X-Content-Type-Options and referrer-related policies that affect how browsers interpret responses and share referring information. The analyzer helps surface missing or inconsistent directives, but the correct setting depends on the site's application behavior and privacy requirements.
Why Security Headers Need Contextual Review
Security response headers can reduce exposure to browser-based risks such as script injection, clickjacking, and unsafe content interpretation, but they need to match the application they protect. A header can be missing, duplicated, or configured too broadly, and an overly strict policy can also break legitimate resources. Use the analyzer to identify the live directives, then validate each finding against the site's actual behavior before deploying changes.
Frequently asked questions
Which security headers should I review first?
Start with CSP, HSTS, and X-Frame-Options because they address different browser security concerns and often require application-specific decisions. The best order depends on the issue you are investigating, so inspect the live response first and avoid copying a strict policy without testing how the site loads, frames, and serves content.
Where should I configure security headers?
Set them at the layer that actually controls the final response, such as the web server, CDN edge, reverse proxy, or application framework. After a change, inspect the live response again because downstream infrastructure can add, remove, duplicate, or overwrite headers.