HTTP Headers Checker

Sensible values for the security headers

Strict-Transport-Security: max-age=31536000; includeSubDomains makes browsers use HTTPS for a year; add includeSubDomains only when every subdomain serves HTTPS with a valid certificate, which the SSL checker confirms name by name. X-Content-Type-Options: nosniff has one valid value. Referrer-Policy: strict-origin-when-cross-origin is the browser default and sends other sites only your domain. X-Frame-Options: DENY stops other sites framing your pages; the modern equivalent is frame-ancestors 'none' in the Content Security Policy.

Introducing a Content Security Policy

A CSP lists where scripts, styles, images, and frames may load from, and a strict one breaks any page that loads something it does not list. Roll it out as Content-Security-Policy-Report-Only first: browsers report violations in the console, or to an endpoint you name, without blocking anything. Tighten the policy until the reports stop, then switch to the enforcing header. Headers set by a CDN or proxy appear here alongside your server's own, so a header you removed may still be added upstream.

How to use it

1. Enter a public page or resource URL.
2. Choose Read headers.
3. Review the complete header ledger and the common security-policy summary.

Privacy & limitations

The URL is checked through TOEA’s API and is not saved. Set-Cookie and proxy authentication header values are redacted from the result.