HTTP Header Analyzer

Use curl: run 'curl -I https://example.com' to see response headers. In Chrome/Firefox DevTools, open Network tab, click a request, and look at the Response Headers section. In Postman, the headers panel shows all response headers. Copy the header lines and paste them here.

The five most important security headers are: Strict-Transport-Security (enforce HTTPS), Content-Security-Policy (block XSS), X-Frame-Options (prevent clickjacking), X-Content-Type-Options: nosniff (block MIME sniffing), and Referrer-Policy (control referrer leakage). Permissions-Policy is also recommended to restrict browser APIs you don't use.

CSP is a browser security layer that controls which sources of scripts, styles, images, and other resources are allowed. A policy like 'default-src self' blocks all inline scripts and external resources by default. This eliminates most XSS vectors. Start with report-only mode using Content-Security-Policy-Report-Only to audit before enforcing.

no-store tells browsers and CDNs to never store a copy of the response — not in memory, not on disk. Use this for responses containing sensitive data (banking pages, health records, authenticated user data). It's more restrictive than no-cache, which allows storage but requires revalidation before use.

These headers reveal your server software and version (e.g., 'nginx/1.18.0' or 'Express'). Attackers use this to target known CVEs for that specific version. Remove them to reduce information disclosure: use 'server_tokens off' in Nginx, or 'app.disable(x-powered-by)' in Express.