PresentContent-Security-Policy
Enforced CSP is present
Review its directives and real resource needs; presence alone does not make the policy strong.
default-src 'self'; script-src 'self' 'unsafe-inline'; img-src 'self' data:; object-src 'none'Web Security Headers & CSP Checker
Local review · optional URL checkAudit response headers, CSP, cookies, and CORS, then generate practical deployment fixes.
Response headers
Repeated headers such as Set-Cookie are preserved.
70
/ 100
1
High priority
3
Review
4
Present
6
Context
Configuration review, not a security verdict
The score covers visible response controls only. It does not test application vulnerabilities, TLS deployment, server patches, authentication, or business logic.
ReviewContent-Security-Policy−7
CSP allows inline code or styles
Prefer nonces or hashes for scripts and remove inline-style allowance when the application permits.
'unsafe-inline'ReviewStrict-Transport-Security−7
HSTS max-age is short
After validating HTTPS coverage, increase max-age toward a long-lived production policy.
max-age=86400ContextStrict-Transport-Security−2
HSTS excludes subdomains
Consider includeSubDomains only after verifying HTTPS for the complete namespace.
max-age=86400PresentX-Content-Type-Options
MIME sniffing protection is present
The nosniff value is configured.
nosniffPresentReferrer-Policy
Referrer policy is present
Review that its cross-origin disclosure matches the application's privacy needs.
strict-origin-when-cross-originContextPermissions-Policy−3
Permissions Policy is missing
Disable unused browser capabilities and delegate required features narrowly.
—PresentX-Frame-Options
Framing protection is present
The response limits which pages may frame this content.
SAMEORIGINContextcross-origin-opener-policy−3
COOP is not declared
Cross-Origin-Opener-Policy can isolate top-level browsing contexts when compatible.
—Contextcross-origin-resource-policy−2
CORP is not declared
Cross-Origin-Resource-Policy can restrict which sites read this resource.
—ContextAccess-Control-Allow-Origin
CORS allows every origin
This can be correct for public resources; do not use it for private user-specific data.
*ReviewSet-Cookie−3
Cookie lacks Secure
Mark session and sensitive cookies Secure so browsers send them only over HTTPS.
sessionHigh prioritySet-Cookie−3
SameSite=None cookie lacks Secure
Cross-site cookies with SameSite=None must also use Secure.
sessionContextserver
Server technology is disclosed
Reduce unnecessary product/version details, while remembering that hiding them is not a security control.
demo/1.0How to use it
- 01
Provide response evidence
Paste a raw header block, import a HAR response, or explicitly try a browser URL check with its CORS limitations.
- 02
Review findings
Inspect weighted, evidence-based findings for CSP, HSTS, framing, referrers, permissions, cross-origin isolation, CORS, and cookies.
- 03
Build and deploy a fix
Create a suitable CSP, review the generated header set, and copy a snippet for your deployment platform.
Frequently asked questions
Does a high grade prove the site is secure?
No. This is a response-configuration review, not a vulnerability scan, penetration test, or compliance certification.
Why is paste or HAR the reliable input?
CORS can prevent a third-party web page from reading another site's response headers. HAR or copied headers preserve the evidence you can inspect locally.
Can I paste Set-Cookie multiple times?
Yes. Repeated headers are preserved and every cookie is checked separately for Secure, HttpOnly, SameSite, prefix, domain, and path behavior.
Should I deploy the generated CSP unchanged?
No. Start in Report-Only where practical, inventory real resource origins, test every user flow, and tighten the policy for your own application.
Related tools
Keep working with other focused browser utilities.