ChistStudioWhat gets checked
This tool requests the page and inspects six response headers that browsers use to enforce security policies: Strict-Transport-Security, Content-Security-Policy, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, and Permissions-Policy. Each is a low-cost, server-side configuration change that meaningfully reduces the attack surface of a site without touching application logic.
Frequently asked questions
Why do security headers matter if the site already uses HTTPS?
HTTPS protects data in transit; security headers protect against a different class of attacks inside a legitimate encrypted connection, like XSS and clickjacking. The two are complementary.
Which security header should I add first if I only fix one?
Strict-Transport-Security is usually the highest-leverage single addition. Content-Security-Policy gives the strongest overall protection but needs more careful configuration.
Can I check a site I don't own with this tool?
Yes — it only reads publicly served response headers, the same information any browser receives visiting normally. No intrusive testing is performed.