Audit a site's security headers

Eight headers carry most of a page's browser-side defense — check which are present and sane.

Tools used in this guide

Security header audit

The job

CSP, HSTS, X-Content-Type-Options, frame protection, Referrer-Policy, Permissions-Policy, COOP, CORP — the headers that turn XSS and clickjacking from 'exploitable' to 'attempted'. Revealing headers like Server and X-Powered-By are flagged too.

Paste the response

Paste the raw header block (curl -i output works, up to 500 KB). The report grades each header present/misconfigured/missing with what to set instead.

Worked example

A response with only 'Content-Type' scores red on all eight; adding 'X-Content-Type-Options: nosniff' and 'Referrer-Policy: strict-origin-when-cross-origin' are the cheap first fixes.

Where it stops

It grades the text you paste — not the live site, not TLS config, not CSP's actual rule strength beyond flags like unsafe-inline. A pasted header set is an audit input, not a scan.