Browser security headers
CSP, HSTS, X-Frame-Options and related browser security policies, graded by configuration. Free, no signup, 5 checks a day.
You can open any section directly with a domain in the URL query string, then share that result page with someone else.
How to read this result
These notes explain what the check is showing, where the data comes from and what the main blind spots are.
CSP
Content-Security-Policy — names the sources a page is allowed to load. A CSP that includes 'unsafe-inline' is marked weak: it is present, but it no longer stops the injections it exists to stop.
HSTS
Strict-Transport-Security — tells browsers to refuse plain HTTP for a window of time. A one-minute max-age is marked weak: it is a policy that expires before most visitors come back.
Framing
X-Frame-Options — decides whether other sites may embed this one in a frame. Missing means your pages can be framed by anyone — the classic clickjacking surface.
MIME sniffing
X-Content-Type-Options — stops browsers from guessing a file's type when the declared type is missing. Without it, an uploaded file that pretends to be HTML can run as one.
Referrer
Referrer-Policy — controls what the browser leaks about the previous page in the URL of the next request. The stricter it is, the less of your users' path appears in third-party logs.
Permissions
Permissions-Policy — switches off browser features (camera, microphone, geolocation) for the page and its frames. Absent means every feature is on until some script asks for it.
COOP
Cross-Origin-Opener-Policy — isolates the browsing context so a cross-origin popup cannot hold a reference to this window. Missing weakens the wall between your page and the sites it opens.
CORP
Cross-Origin-Resource-Policy — says which origins may embed this page's resources. Without it, any other origin can read what this page serves.