HTTP security headers: what is a site sending, and what is missing?
Will fetch a URL's response headers and explain which security headers (CSP, HSTS, X-Content-Type-Options, Referrer-Policy, Permissions-Policy) are present, with a suggested value for each one missing and a simple overall score so results stay scannable. Coming with the AdminKit Check API.
Which recommended HTTP security response headers a URL sends, and which are missing, with a suggested value for each gap.
- Content-Security-Policy, HSTS, X-Content-Type-Options, Referrer-Policy, Permissions-Policy and more
- A simple overall score plus the detail underneath
- Ships with the AdminKit Check API (plan milestone M5)
Next step
Check the same host's TLS configuration, or see which ports are open on it.
How it works and limits
HTTP response headers such as Content-Security-Policy and Strict-Transport-Security tell browsers how to defend a site’s visitors against clickjacking, mixed-content downgrades and cross-site scripting — but they only work once a site actually sends them, and it is easy to ship a site that never does.
What it will check
- Whether each recommended header (CSP, HSTS, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, and a few others) is present.
- A plain-language explanation of what each header does and a suggested value when it is missing.
- A simple overall score so the result is scannable at a glance, with the detail underneath.
Why this is not live yet
It ships with the AdminKit Check API so results can be cached and the outbound fetch to arbitrary URLs can be rate limited and sandboxed safely, rather than run directly from a public Pages Function.
Check manually today
curl -sI https://example.com/This prints the response headers directly. Compare the list against the OWASP Secure Headers Project’s reference table to see which are present and what each one should contain.
Frequently asked questions
Why is this tool not live yet?
It ships with the AdminKit Check API (plan milestone M5) so results can be rate-limited and cached safely.
What can I check manually today?
curl -I https://example.com/ prints the response headers directly from the command line.