Website Security Header Scanner & CSP Analyser
Instant client-side security header auditor and Content Security Policy (CSP) analyser.
Audit Target & Headers
Security Audit Results
max-age=63072000; includeSubDomains; preload
default-src 'self'; script-src 'self'; style-src 'self'...
DENY
nosniff
strict-origin-when-cross-origin
camera=(), microphone=(), geolocation=()...
Cross-Origin-Opener-Policy: same-origin
Quick Fix Server Config Generator
# Add to Nginx server block:
add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-Frame-Options "DENY" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;About this tool
How to use it
- Select a preconfigured server profile or paste your site's raw HTTP response headers directly from Chrome DevTools or curl -I.
- Inspect the overall security score and letter grade (A+ through F) based on OWASP and Mozilla Observatory evaluation standards.
- Review individual header breakdowns for Content-Security-Policy (CSP), HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy.
- Expand any failing or warning header to read vulnerability remediation guidance and risk analysis.
- Switch to the Fix Generator tab to generate drop-in configuration snippets for Nginx, Apache .htaccess, Cloudflare, or Node.js Express Helmet.
Why it matters
Modern web application attacks like Cross-Site Scripting (XSS), clickjacking, MIME-type confusion, and protocol downgrade attacks can often be prevented simply by deploying well-configured HTTP security headers. This client-side scanner provides instant diagnostics, scoring, and production-ready server configuration snippets without leaking your server headers to third parties.
When to use it
Use when auditing new website deployments, preparing for SOC 2 or ISO 27001 compliance reviews, hardening cloud reverse proxies, or troubleshooting strict CSP violations.
Common questions
What is the most critical HTTP security header to implement?
Strict-Transport-Security (HSTS) and Content-Security-Policy (CSP) are considered the most impactful. HSTS prevents SSL-stripping and man-in-the-middle attacks, while CSP prevents cross-site scripting (XSS) and malicious script injection.
Why does clickjacking occur without X-Frame-Options or CSP frame-ancestors?
Without frame restrictions, malicious websites can embed your application inside a transparent iframe, tricking authenticated users into clicking buttons or submitting forms without their knowledge.
What is the difference between X-Frame-Options and CSP frame-ancestors?
X-Frame-Options is an older legacy header supporting only DENY and SAMEORIGIN. CSP's frame-ancestors directive is modern, flexible, supports multiple allowed parent domains, and overrides X-Frame-Options in modern browsers.
Does this tool run privately without sending server headers to external servers?
Yes! All header parsing, regex analysis, OWASP scoring, and web server configuration generation runs 100% locally inside your web browser's JavaScript sandbox.