Security Headers Checker

Tells the browser to only ever connect to your domain over HTTPS, for a period of time you set. Without it, a visitor who types your domain without "https://" can be silently downgraded to plain HTTP by an on-path attacker.

Restricts which sources scripts, styles, images, and other resources can load from. It's the strongest defense against XSS beyond input sanitization: even if an attacker injects a script tag, a good CSP stops it from running.

Stops the browser from MIME-sniffing a response into a different content type than the server declared. Without it, a file uploaded as an image can, in some cases, be executed as a script.

Controls whether your pages can be loaded inside an <iframe> on another site. Without it, an attacker can frame your page invisibly and trick users into clicking things they didn't mean to (clickjacking).

Controls how much of your page's URL is sent in the Referer header when a user clicks an outbound link. Full URLs can leak session tokens, search terms, or internal paths to third-party sites.

Declares which browser features (camera, microphone, geolocation, USB, and more) your page and any embedded iframes are allowed to use. Only disable features your app genuinely doesn't need.

Isolates your page's browsing context from cross-origin windows that open it, closing off a class of cross-window side-channel attacks. Can interfere with OAuth popup flows that rely on window.opener, so check that first.

Requires cross-origin resources to explicitly opt in before your page can load them. Mainly relevant if you use SharedArrayBuffer, WASM threads, or other APIs that need cross-origin isolation.

Restricts which origins can load a given resource directly, such as in an <img> or <script> tag on another site. Useful for endpoints returning sensitive data.