Tools

Security headers analyzer

Paste the response headers of a page and check transport security, content policy, framing, referrer and permissions policy, cross-origin isolation, caching and cookies.

LOCAL UTILITY / 04

Analyze response headers

Paste the headers of one HTTP response, with or without the status line. The analyzer does not fetch URLs: the headers you paste are checked in this browser and not sent anywhere.

Loading the local analyzer… If this remains visible, refresh the page.

Header report

Header checks
Check	Result	Evidence and what to do

Get the headers to paste

From a terminal, ask for the page you want to check and keep only the headers. Check a signed-in page as well as the home page: caching and cookie attributes matter most on responses with personal data.

Shell

curl -sS -D - -o /dev/null https://www.example.com/account

In a browser, open the developer tools, select the request in the Network panel and copy its response headers. Headers are only part of the picture: they do not show whether the application escapes output or authorizes requests.

What is checked

Strict-Transport-Security: max-age, includeSubDomains, preload requirements and max-age=0
Content-Security-Policy, with every enforced policy evaluated, and report-only policies
X-Content-Type-Options: nosniff
Framing: CSP frame-ancestors, which takes precedence, or X-Frame-Options DENY or SAMEORIGIN
Referrer-Policy (the last recognised value applies) and Permissions-Policy
Cross-Origin-Opener-Policy, Cross-Origin-Embedder-Policy and Cross-Origin-Resource-Policy, and cross-origin isolation
Cache-Control on responses with personal or session data
Each Set-Cookie: Secure, HttpOnly, SameSite, the __Host- and __Secure- prefixes, Domain, Partitioned and lifetime
Legacy and revealing headers: X-XSS-Protection, Server and X-Powered-By versions, and wildcard CORS with credentials

Source specifications

Guides and practice

All tools

Guide

Configure HTTP security headers from a tested baseline

Send the response headers that make browsers enforce HTTPS, run only your own scripts, refuse hostile framing and keep cookies on one host, then prove they appear on every kind of response.

Guide

Configure CORS and CSP around the browser capabilities you need

Control who can read API responses and which resources a page may execute without confusing either control with authorization.

Guide

Session management: cookies, timeouts, rotation and revocation

Model authentication as transitions in server authority, set session cookies and timeouts to current NIST and OWASP values, and verify fixation prevention, expiry, reauthentication, revocation and stolen-cookie defenses.

Lab · Foundation · 20–30 min

CSRF lab: Protect an account change from a forged request

An account settings handler trusts the session cookie even when another site causes the request. Repair the request policy and preserve legitimate settings updates.

Security headers analyzer

Analyze response headers

Header report

Cookies

Content Security Policy findings

Get the headers to paste

What is checked

Source specifications

Guides and practice

Configure HTTP security headers from a tested baseline

Configure CORS and CSP around the browser capabilities you need

Session management: cookies, timeouts, rotation and revocation

CSRF lab: Protect an account change from a forged request

Find your next answer