HTTP Security Headers (CSP, HSTS, X-Frame) InspectorOWASP Hardened
Audit website HTTP response headers for missing Content-Security-Policy, Strict-Transport-Security, and X-Frame-Options with 100% browser-local privacy.
Run this command in your terminal to fetch any staging or production headers, then paste the output into the box above.
100% Browser-Isolated Privacy
Unlike remote header scanners that send your internal hostnames or tokens to cloud servers, this tool evaluates everything locally inside your browser sandbox. No target endpoints, IP addresses, or cookies are ever recorded or transmitted.
Awaiting HTTP Response Headers
Paste raw HTTP headers in the workbench on the left, or test a predefined security baseline from our OWASP presets below.
HTTP Security Headers Architecture & Threat Defense Guide
Modern web applications rely on HTTP response headers as a first line of defense against Cross-Site Scripting, clickjacking, protocol downgrades, and data exfiltration.
Content-Security-Policy (CSP)
CSP restricts the sources from which scripts, styles, images, and fonts may load. By defining strict source directives and forbidding 'unsafe-inline' without nonces or hashes, it renders reflected and stored XSS attacks ineffective.
Strict-Transport-Security (HSTS)
HSTS forces compliant web browsers to strictly communicate over encrypted HTTPS connections. This thwarts SSL stripping, man-in-the-middle attacks on public Wi-Fi networks, and prevents unencrypted plaintext session cookie transmission.
X-Frame-Options (Clickjacking)
Clickjacking occurs when an attacker renders your authenticated website inside a transparent or hidden iframe to trick users into clicking buttons. Declaring X-Frame-Options: DENY completely prevents third-party framing.
Frequently Asked Questions
Public web scanners require you to submit target domains to external cloud servers, which logs your internal intranet hostnames, staging URLs, or dev environments. This tool runs 100% locally in your browser with zero network requests and zero data storage.
Open Chrome or Firefox DevTools (F12) → Network Tab → reload the page → select the first document request → copy the Response Headers. Alternatively, run curl -I https://your-site.com in your terminal.
By appending the preload directive and setting a max-age of at least 1 year (31536000 seconds), your site can be baked directly into the hardcoded HSTS list shipped in Chrome, Firefox, Safari, and Edge.
Modern browsers removed the legacy XSS auditor because attackers discovered ways to exploit the filter to leak sensitive script content or introduce new vulnerabilities. CSP is the modern, secure replacement.