Security Headers & CSP Auditor

Audit public URL or pasted HTTP response headers for CSP, HSTS, cookies, CORS, privacy, isolation, and deprecated controls, with a transparent heuristic score.

URL checks use a constrained server proxy: public HTTP(S), standard ports, per-hop DNS/redirect validation, a 1 MB body limit, and redacted Set-Cookie values. The transparent score is heuristic—not a security certification.

Site profile

Online URL

About Security Headers & CSP Auditor

Inspect response headers, analyze CSP, and generate deployment snippets. Audit public URL or pasted HTTP response headers for CSP, HSTS, cookies, CORS, privacy, isolation, and deprecated controls, with a transparent heuristic score.

Key capabilities

Check modern transport, privacy, isolation, cookie, and CORS controls
Parse multiple CSP policies, source expressions, duplicates, and risky keywords
Fetch only public standard-port URLs with DNS pinning and redirect validation
Generate escaped Nginx, Apache, Caddy, Vercel, and Nuxt examples

Useful for

Review production response headers after a deployment
Move from report-only CSP to a narrower enforcing policy
Spot wildcard, credential, and cache variation mistakes

Frequently asked questions

Is Security Headers & CSP Auditor free to use online?

Yes. Security Headers & CSP Auditor opens in a modern browser and does not require desktop software installation.

What is Security Headers & CSP Auditor useful for?

Common use cases include Review production response headers after a deployment; Move from report-only CSP to a narrower enforcing policy.

Does this tool make network connections?

Some Security Headers & CSP Auditor features need to connect to a target service or load online data. Follow the page guidance and access only resources you are authorized to use.

Comments

0 comments

AAccount

No comments yet. Be the first to leave feedback.