HTTP Header & Security Checker
Scan response headers for security best practices and check for HSTS, CSP, and CORS configurations.
HTTP Headers & Security FAQ & Guide
What are HTTP headers?
HTTP headers pass additional information with an HTTP request or response. Server response headers contain metadata about the response, such as content type, caching instructions, server software, and security policies.
Why are security headers important?
Security headers provide a crucial layer of defense-in-depth. They tell the user's web browser how to behave when handling site content, preventing client-side vulnerabilities like Cross-Site Scripting (XSS), session hijacking, frame injections, and content sniffing.
What is a Content Security Policy (CSP)?
Content Security Policy is an HTTP header that restricts where resources (such as JavaScript, CSS, images, and fonts) can be loaded from. A strict CSP makes it nearly impossible for attackers to run unauthorized script injections on your site.
What does HTTP Strict Transport Security (HSTS) do?
The `Strict-Transport-Security` header instructs browsers to only connect to the domain using secure HTTPS connections. This prevents protocol downgrade attacks and cookie hijacking on public networks.