HTTP Security Headers Reviewer

Choose the response that matters

An HTML document, a JSON API and a downloadable file do not have identical needs. Headers may differ by path, status, CDN or authenticated state. This tool sees only what you paste, so keep that context with the result. It never contacts the website to confirm the configuration.

A CSP needs more than a presence check

Content Security Policy can constrain scripts, framing and other browser behaviour. A report-only policy observes violations without enforcing the policy. Multiple enforced policies apply together; they should not be treated as a single last-header-wins value. The checker reviews selected patterns, not every directive combination or application dependency.

HSTS has a deployment prerequisite

Strict-Transport-Security is meaningful when received over a valid HTTPS connection. A pasted header cannot prove certificate validity or safe HTTPS coverage for every subdomain. Do not copy includeSubDomains or preload settings into production until those commitments fit your domain setup.

Missing does not automatically mean exploitable

A warning gives you a question to investigate. It is not a penetration-test finding. Before deploying a stricter policy, check embeds, asset loading and application flows in a suitable environment. Keep a rollback plan for configuration that could prevent a real user from completing a task.

References

• Content Security Policy, MDN
• Strict-Transport-Security, MDN
• HTTP security response headers, OWASP

Documentation reviewed: 1 November 2026. Rule results describe the supplied text, not a live application test.

Useful next steps

• JWT Inspector
• Security Report Builder
• Practical guides and coding projects

Maintained by MetaCyberGuru. A review point may need source, runtime or deployment context before you act on it.