Free tool

HTTP security header check

Enter a web address to see its live HTTP response headers and a plain-English assessment of the security-relevant ones — Strict-Transport-Security, Content-Security-Policy, the clickjacking and content-type protections, cross-origin isolation, cookie flags and any information the server gives away.

Headers are read from Spoofhound's network over HTTPS. The exact path you enter is honoured — headers can differ per page. Long values are truncated for display; see below for how to list them in full yourself.