About http header analyzer
Security headers instruct browsers to protect your visitors. Paste a response's headers and get a review.
Important headers
- Strict-Transport-Security (HSTS) forces HTTPS.
- Content-Security-Policy limits where scripts and other resources load from.
- X-Content-Type-Options: nosniff stops MIME sniffing.
- X-Frame-Options or frame-ancestors prevents clickjacking.
- Referrer-Policy and Permissions-Policy limit what is shared with others.
Rollout
Test a new Content-Security-Policy in report-only mode first so you do not break your own site.
Runs in your browser
Calculations on this page happen on your device. Nothing you enter is uploaded.
A worked example
A response with Strict-Transport-Security: max-age=31536000; includeSubDomains, X-Content-Type-Options: nosniff and a Content-Security-Policy passes the main checks. A response that has no frame protection or no HSTS is reported, with advice on adding the header.
Rolling out CSP safely
- Start with Content-Security-Policy-Report-Only and watch the reports.
- Allow only the scripts and styles you really use.
- Avoid unsafe-inline where you can, by using nonces or hashes.
