HTTP Header Inspector

HTTP security headers are response headers that instruct browsers on security policies. Key ones include Content-Security-Policy (prevents XSS), Strict-Transport-Security (enforces HTTPS), X-Frame-Options (prevents clickjacking), X-Content-Type-Options (prevents MIME sniffing), and Referrer-Policy (controls referrer data).

CSP (Content-Security-Policy) is a header that tells browsers which resources are allowed to load. It can prevent XSS attacks by blocking inline scripts, limiting script sources to trusted domains. A strict CSP like "default-src 'self'" only allows resources from the same origin.

HSTS tells browsers to always use HTTPS for a domain, even if the user types http://. The max-age directive sets how long to remember this (31536000 = 1 year). includeSubDomains extends it to all subdomains. preload submits the domain to browser preload lists, so HTTPS is enforced from the very first visit.

The Server header reveals what web server software you're using (e.g., nginx/1.24.0, Apache/2.4.51). Attackers use this information to target known vulnerabilities. It's a good practice to remove or obscure this header in production.

Without this header, browsers may try to 'sniff' the content type of a response, potentially treating a text file as JavaScript and executing it. Setting X-Content-Type-Options: nosniff prevents this behavior, requiring browsers to trust the declared Content-Type.