Security Headers - Tester

This tool checks HTTP security headers for any domain. It evaluates active security headers recommended for production websites:

• Content-Security-Policy — Prevents XSS and data injection attacks
• X-Content-Type-Options — Prevents MIME type sniffing
• X-Frame-Options — Prevents clickjacking attacks
• Strict-Transport-Security — Forces HTTPS connections
• Referrer-Policy — Controls referrer information leakage
• Permissions-Policy — Controls browser feature access
• Cross-Origin-Opener-Policy — Isolates browsing context
• Cross-Origin-Resource-Policy — Prevents cross-origin resource leaks
• Cross-Origin-Embedder-Policy — Controls cross-origin loading
• Cache-Control — Security-relevant caching policy
• Set-Cookie — Cookie security flags
• X-Powered-By — Server technology fingerprinting
• Report-To — CSP violation reporting endpoint

Deprecated headers (X-XSS-Protection, Expect-CT) are checked but not counted in the score. Their presence generates a suggestion to remove them.

Each active header present earns points toward a total score of 100.