Loading Security Headers Analyser…
This reads text you paste and makes no request of its own. It cannot fetch a domain for you, deliberately: a tool that took a hostname and went and asked it for headers would be pointing a scanner at hosts its visitors may not own, and would be sending us somebody else’s address into the bargain.
A status line, curl’s < prefixes, folded continuation lines and blank lines are all fine. Repeated headers are combined the way a browser combines them, except Set-Cookie, which never is.
Paste a set of response headers and each one is judged here.
Any HTML injection on this page becomes script execution, because nothing tells the browser which sources are legitimate. This is the header that changes the outcome of the bug class rather than the odds of it.
CSP Level 3
A visitor who types the bare domain, or follows an old http:// link, makes one plaintext request that can be answered by whoever is between them and you. Redirecting to https is not a substitute: the redirect itself travels in the clear.
RFC 6797
The browser may sniff a response body and decide it is HTML or script despite the declared type. On any endpoint that serves files people uploaded, that is how a text file becomes a script on your origin.
Fetch Standard, determine nosniff
Nothing stops another site framing this page. Send a CSP frame-ancestors directive instead if you would rather have one mechanism — but one of the two has to be there.
RFC 7034
The browser falls back to its own default, and current Chrome and Firefox default to strict-origin-when-cross-origin, so the practical exposure is smaller than it used to be. Stating it is still cheaper than depending on it.
W3C Referrer Policy
Features are governed by browser defaults, which for camera, microphone and geolocation already require a user prompt. The header is what keeps a third-party frame from being the thing that asks.
W3C Permissions Policy
Content-Security-PolicyTurns an HTML injection into a blocked resource instead of executing script, by naming where script, style, frames and connections may come from.
Strict-Transport-SecurityStops the first request going out in plaintext on every visit after the first, so a network attacker cannot strip TLS or redirect the http:// version.
X-Content-Type-OptionsStops the browser second-guessing a declared Content-Type, so an uploaded file served as text/plain is never treated as script or HTML.
X-Frame-OptionsStops another site framing this page invisibly and collecting clicks meant for its own interface.
Referrer-PolicyStops a full URL — including a path or query string holding a token, an order number or a search — being handed to every site you link to or load from.
Permissions-PolicyTurns off device and browser features for this document and anything it frames, so a compromised third-party embed cannot ask for the camera in your name.
Content-Security-PolicyTurns an HTML injection into a blocked resource instead of executing script, by naming where script, style, frames and connections may come from.CSP Level 3Strict-Transport-SecurityStops the first request going out in plaintext on every visit after the first, so a network attacker cannot strip TLS or redirect the http:// version.RFC 6797X-Content-Type-OptionsStops the browser second-guessing a declared Content-Type, so an uploaded file served as text/plain is never treated as script or HTML.Fetch Standard, determine nosniffX-Frame-OptionsStops another site framing this page invisibly and collecting clicks meant for its own interface.RFC 7034Referrer-PolicyStops a full URL — including a path or query string holding a token, an order number or a search — being handed to every site you link to or load from.W3C Referrer PolicyPermissions-PolicyTurns off device and browser features for this document and anything it frames, so a compromised third-party embed cannot ask for the camera in your name.W3C Permissions PolicyCross-Origin-Opener-PolicySevers the window relationship with a page that opened yours or that you opened, which closes cross-window scripting and the tabnabbing family.HTML StandardCross-Origin-Embedder-PolicyRefuses cross-origin subresources that have not opted in, which is the second half of the cross-origin isolation requirement.HTML StandardCross-Origin-Resource-PolicyStops another site embedding this response at all, which is the defence against side-channel reads of a resource the attacker can never see directly.Fetch Standard, cross-origin resource policyCache-ControlKeeps a page rendered for one signed-in person out of shared caches and off the disk of a shared machine.RFC 9111Set-CookieNothing by itself — its attributes are where the protection lives.RFC 6265bisAccess-Control-Allow-OriginNothing. It is a relaxation of the same-origin policy, and it needs reading as one.Fetch Standard, CORS protocolX-XSS-ProtectionNothing any more. It configured a reflected-XSS filter that no current browser ships.never standardisedExpect-CTNothing now. Certificate Transparency enforcement moved into the browsers themselves.RFC 9163, retiredPublic-Key-PinsNothing. Browsers removed HTTP Public Key Pinning.RFC 7469, obsoleteServerNothing. It describes the software answering the request.RFC 9110 § 10.2.4X-Powered-ByNothing. It advertises the framework.no specificationA full set of headers is not the same as a secure application. Every one of these narrows what a bug can be turned into; none of them fixes the bug. A page with all six and a broken authorisation check is still wide open.
A response header is a short instruction to the browser about how to treat the document arriving with it. Six carry most of the weight. Content-Security-Policy limits what an injection is able to execute. Strict-Transport-Security removes the plaintext request that would otherwise start every visit. X-Content-Type-Options prevents a file being re-interpreted as something more dangerous than its declared type. X-Frame-Options, or a frame-ancestors directive doing the same job, keeps the page out of a stranger’s frame. Referrer-Policy keeps your own URLs out of other people’s access logs. Permissions-Policy switches off device features the page has no use for.
Not one of them repairs a defect. Each narrows what a defect can be escalated into, which is a cheaper class of win altogether: they are configuration rather than code, and they take effect across every route at once.
X-XSS-Protection configured a filter Chrome removed in 2019 and Firefox never shipped. Expect-CT is published as Historic, because certificate transparency is now demanded of publicly trusted certificates whether a site asks for it or not. Public-Key-Pins was withdrawn from browsers after too many operators pinned themselves off the internet for the length of their own max-age.
All three are inert. The cost of keeping them is not the handful of bytes; it is that a reader mistakes them for protection. Server and X-Powered-By are the same problem pointing the other way, telling anyone sorting hosts by exploit which published vulnerability to try against yours first.
Cross-Origin-Opener-Policy severs the window relationship between your document and whatever opened it. Cross-Origin-Embedder-Policy refuses cross-origin subresources that have not explicitly opted in. Set to same-origin and require-corp, the pair makes a document cross-origin isolated, which is the gate on SharedArrayBuffer and on timers that are not deliberately blunted.
This is not general hardening. Enabling the second one breaks every cross-origin image, font and frame that does not send a Cross-Origin-Resource-Policy of its own, so it is a migration to plan rather than a line to add on a Friday afternoon.
A scanner that accepts a domain name and fetches it is issuing requests to a host on a stranger’s say-so, with no way of knowing whether the person typing owns it. It would also put that domain in our logs, and not doing that is a commitment this site’s privacy policy makes explicitly.
So this reads pasted text and nothing else. Open the network panel, click the document request, and copy the response headers; or run curl with the -I flag and paste what comes back. Either way the assessment happens on your machine.
Only if you want the very first visit protected too, before any header has been seen. Submission requires a year of max-age, includeSubDomains and the preload token, and removal takes months, so it commits every subdomain you will ever create to HTTPS.
Where a Content-Security-Policy carries frame-ancestors, browsers enforce that and ignore the older header entirely. Sending both is harmless belt and braces for anything that only understands the header, and the directive is the one to edit.
No, and the name is the trap. It means revalidate before reusing, and the copy is stored either way. The directive that says do not keep this at all is no-store, which is what a page rendered for one signed-in person needs.
Deny the features you are certain you do not use, written as an empty allowlist: camera=(), microphone=(), geolocation=(). That is exactly what this site sends. Adding more is easy once you know which frames on the page need what.
It means one class of attack got harder. An authorisation check that trusts a parameter, or a query built by string concatenation, is untouched by anything in this list. Headers are the cheap layer, not the important one.