Inspect HTTP response headers and identify missing or weak browser protections.
Enter a public domain or URL. HTTPS is used by default.
Checks the initial HTTP response only. Redirects are displayed but not followed.
Content-Security-Policy, HTTP Strict Transport Security, frame restrictions, MIME-sniffing protection, Referrer-Policy, Permissions-Policy, and related HTTP response headers.
Findings are informational and do not constitute a complete website security assessment.