Back to Tools

HTTP Security Headers Validator

Scan your website's HTTP response headers for security misconfigurations. Get a detailed report with severity ratings and fix recommendations.

What We Check

Critical Headers

Strict-Transport-Security (HSTS), X-Content-Type-Options, X-Frame-Options, Referrer-Policy

CSP Analysis

Content-Security-Policy directives, unsafe-inline/unsafe-eval detection, nonce/hash validation

Information Disclosure

Server, X-Powered-By, X-AspNet-Version — headers that leak tech stack info

Cookie Security

Secure, HttpOnly, SameSite flags on Set-Cookie headers