HTTP Security Headers & SSL Scanner
Evaluate domain defensive posture from A+ to F across CSP, HSTS, X-Frame-Options, and Permissions-Policy with 1-click ready-to-copy code fixes for Next.js, Nginx, Apache, and Cloudflare Workers.
Grade A Security Posture
Optimal6 passing, 1 warnings, 1 missing
Strict-Transport-Security (HSTS)
Forces browsers to exclusively connect over HTTPS, preventing SSL stripping and man-in-the-middle attacks.Content-Security-Policy (CSP)
Restricts sources from which scripts, styles, images, and other resources can be loaded, neutralizing XSS and data injection.X-Frame-Options
Prevents malicious sites from embedding your web application inside an <iframe>, defending against clickjacking attacks.X-Content-Type-Options
Instructs browsers not to MIME-sniff response bodies away from the declared Content-Type.Referrer-Policy
Controls how much referrer information (URL paths, sensitive query parameters) is shared with third-party sites.Permissions-Policy
Disables intrusive browser APIs and hardware features (Camera, Microphone, USB, Geolocation) by default.Cross-Origin-Opener-Policy (COOP)
Isolates top-level browsing context to prevent Spectre-like side-channel attacks across windows.Cross-Origin-Resource-Policy (CORP)
Blocks no-cors cross-origin reads of static assets and sensitive data.Defensive Posture & Web Security Guarantee
Header auditing evaluates adherence to OWASP Top 10 recommendations and modern browser security primitives (HSTS preload, CSP Level 3, COOP/COEP process isolation).
Comprehensive Technical Guide & Reference
Scan any live domain or simulate headers manually to compute an A+ to F security health score, identify missing defensive headers, and export configuration snippets for major web servers.
11. Step-by-Step: How to Audit & Harden HTTP Headers
Strengthen your web application's defensive security posture:
- •Scan Domain: Enter any website URL to fetch and evaluate response headers in real time.
- •Inspect Security Grade: Review your overall letter grade (A+ down to F) with granular weights assigned across 6 core defensive headers.
- •Identify Missing Protections: Review actionable vulnerability explanations for missing CSP, HSTS, or anti-clickjacking headers.
- •Deploy 1-Click Server Fixes: Switch to the '1-Click Code Fixer' tab and copy production configurations for Next.js `next.config.ts`, Nginx `nginx.conf`, Apache `.htaccess`, or Cloudflare Workers.
22. Technical Explanation: The 6 Critical Defense-in-Depth Headers
Modern browsers enforce strict security boundaries based on instructions delivered via HTTP response headers:
- •Strict-Transport-Security (HSTS): Enforces HTTPS connections and disables insecure downgrade attacks (`max-age=31536000; includeSubDomains; preload`).
- •Content-Security-Policy (CSP): Restricts executable script, stylesheet, and frame origins, blocking Cross-Site Scripting (XSS) and data exfiltration.
- •X-Frame-Options: Prevents clickjacking by controlling whether the site can be embedded in an `<iframe>` (`DENY` or `SAMEORIGIN`).
- •X-Content-Type-Options: Prevents MIME-type sniffing of user-uploaded assets (`nosniff`).
- •Referrer-Policy: Prevents sensitive token leakage in the HTTP Referer header (`strict-origin-when-cross-origin`).
- •Permissions-Policy: Disables camera, microphone, and geolocation hardware APIs by default.
33. Content Security Policy (CSP Level 3) Best Practices
Transition from legacy `unsafe-inline` scripts to modern nonce-based CSP policies (`script-src 'nonce-...' 'strict-dynamic'`) to safeguard single-page applications.
Frequently Asked Questions
An A+ grade requires HSTS with max-age >= 1 year, includeSubDomains, preload, a robust Content-Security-Policy (CSP), X-Frame-Options, X-Content-Type-Options, and hidden server version banners.
Related & Recommended Tools
JWT Debugger & Security Studio
Decode, verify signatures, audit security vulnerabilities, and craft JSON Web Tokens locally with Web Crypto API. Zero server transmission.
HTTP Redirect & Status Chain Visualizer
Trace full HTTP redirect chains (301, 302, 307, 308 to 200 OK) with animated hop diagrams, protocol upgrade detection, per-hop latency telemetry, loop warnings, and SEO crawl budget audits.
Universal DNS & MX Record Studio
Concurrent DNS resolution for A, AAAA, MX (priority-sorted), TXT (SPF/DKIM/DMARC linter), CNAME, NS, SOA, and CAA records with RFC 1035 master zone file export.
Meta Tag, Open Graph & Social Card Studio
Audit meta tags, Open Graph og:*, and Twitter cards with pixel-accurate live SERP, Twitter, LinkedIn, and Discord card simulators, character count budgets, and Next.js App Router code export.