Référence technique et guide d'architecture

HTTP Security Headers (CSP, HSTS, X-Frame) Inspector — Guide de référence

Audit website HTTP response headers for missing Content-Security-Policy, Strict-Transport-Security, and X-Frame-Options.

Paramètres clés et contrôles

Headers Inputstring

Configures headers input during client-side http security headers (csp, hsts, x-frame) inspector computation.

Par défaut : Preset sample
Curl Domainstring

Configures curl domain during client-side http security headers (csp, hsts, x-frame) inspector computation.

Par défaut : example.com
HTTP Input Sourcestring | buffer

Primary input payload or parameter set for HTTP Security Headers (CSP, HSTS, X-Frame) Inspector.

Par défaut : Sample preset
Http Security Headers Checker Modeenum / selector

Selects the target processing mode or specification standard for HTTP Security Headers (CSP, HSTS, X-Frame) Inspector.

Par défaut : Standard

Conseils de pro et bonnes practices

default-src 'self'; object-src 'none'; base-uri 'self'; Stri

HSTS forces compliant web browsers to strictly communicate over encrypted HTTPS connections. This thwarts SSL stripping, man-in-the-middle attacks on public Wi-Fi networks, and prevents unencrypted plaintext session cookie transmission.

max-age=31536000; includeSubDomains; preload X-Frame-Options

Clickjacking occurs when an attacker renders your authenticated website inside a transparent or hidden iframe to trick users into clicking buttons. Declaring X-Frame-Options: DENY completely prevents third-party framing.

Pièges courants et dépannage

Unexpected output or validation warning in HTTP Security Headers (CSP, HSTS, X-Frame) Inspector

Verify that your headers input matches the expected string format. Load a built-in sample preset to compare structural formatting.

Exported http security headers checker result differs across target environments

Check the curl domain setting in HTTP Security Headers (CSP, HSTS, X-Frame) Inspector to ensure encoding, precision, or specification version matches your target runtime.

Outils et utilitaires connexes

Tous les outils →