HTTP Security Headers Checker

HTTP security headers are response headers sent by a web server that instruct the browser on how to behave when handling the site's content. They form a crucial second layer of defense on top of application-level security. For example, Content-Security-Policy prevents cross-site scripting (XSS) by whitelisting allowed content sources; Strict-Transport-Security forces HTTPS; X-Frame-Options prevents clickjacking. Missing these headers leaves your application vulnerable even if your code itself has no bugs.

You can retrieve headers in several ways: (1) Open DevTools in Chrome/Firefox, go to the Network tab, reload the page, click the main document request, and look at the Response Headers section. (2) Use curl: run `curl -I https://yourdomain.com` in your terminal — the -I flag fetches only headers. (3) Use online tools like securityheaders.com to scan a live URL. Once you have the raw headers, paste them into this tool to get an instant checklist.

Content-Security-Policy (CSP) is the most powerful security header. It tells the browser which sources are allowed to load scripts, styles, images, fonts, and other resources. A strict CSP like `default-src 'self'` blocks all external resources. In practice you need to allow your CDN, analytics, fonts, etc. Start with `Content-Security-Policy-Report-Only` to collect violations without blocking, then tighten the policy. Avoid `unsafe-inline` and `unsafe-eval` as they undermine most of CSP's protection.

X-XSS-Protection was a header supported by older Internet Explorer and Chrome browsers that enabled a built-in XSS auditor. Chrome removed it in v78 (2019) and most modern browsers ignore it. Security experts now recommend setting it to `0` (disabled) to avoid edge-case bugs in older browsers, and instead relying entirely on a strong Content-Security-Policy for XSS protection. This tool flags X-XSS-Protection as deprecated so you know it provides no real protection in modern browsers.