Free tools
Analyze the HTTP response headers of a domain you confirm you own or are authorized to check, focusing on security signals like HSTS, CSP and Referrer-Policy.
The check makes a short-timeout HEAD request and reports whether Strict-Transport-Security, Content-Security-Policy, X-Frame-Options, Referrer-Policy and Permissions-Policy are present.
A missing header is not always a serious issue — it depends on the application context — but they are usually a recommended improvement.
Frequently asked questions
Only domains you own or are explicitly authorized to check. The tool requires confirming that authorization before querying.
It does not automatically mean the site is vulnerable, but it is usually a recommended security improvement for most applications.