Referencia técnica y guía de arquitectura

HTTP Security Headers (CSP, HSTS, X-Frame) Inspector — Guía de referencia

Audit website HTTP response headers for missing Content-Security-Policy, Strict-Transport-Security, and X-Frame-Options.

Parámetros clave y controles

Headers Inputstring

Configures headers input during client-side http security headers (csp, hsts, x-frame) inspector computation.

Por defecto: Preset sample
Curl Domainstring

Configures curl domain during client-side http security headers (csp, hsts, x-frame) inspector computation.

Por defecto: example.com
HTTP Input Sourcestring | buffer

Primary input payload or parameter set for HTTP Security Headers (CSP, HSTS, X-Frame) Inspector.

Por defecto: Sample preset
Http Security Headers Checker Modeenum / selector

Selects the target processing mode or specification standard for HTTP Security Headers (CSP, HSTS, X-Frame) Inspector.

Por defecto: Standard

Consejos profesionales y mejores prácticas

default-src 'self'; object-src 'none'; base-uri 'self'; Stri

HSTS forces compliant web browsers to strictly communicate over encrypted HTTPS connections. This thwarts SSL stripping, man-in-the-middle attacks on public Wi-Fi networks, and prevents unencrypted plaintext session cookie transmission.

max-age=31536000; includeSubDomains; preload X-Frame-Options

Clickjacking occurs when an attacker renders your authenticated website inside a transparent or hidden iframe to trick users into clicking buttons. Declaring X-Frame-Options: DENY completely prevents third-party framing.

Errores comunes y solución de problemas

Unexpected output or validation warning in HTTP Security Headers (CSP, HSTS, X-Frame) Inspector

Verify that your headers input matches the expected string format. Load a built-in sample preset to compare structural formatting.

Exported http security headers checker result differs across target environments

Check the curl domain setting in HTTP Security Headers (CSP, HSTS, X-Frame) Inspector to ensure encoding, precision, or specification version matches your target runtime.

Herramientas y utilidades relacionadas

Todas las herramientas →