HTTP Security Headers Auditor

An HTTP security header auditor is a diagnostic tool that inspects the response headers sent by a web server to ensure they are configured to prevent security threats. By evaluating key directives like Content-Security-Policy and Strict-Transport-Security, the auditor checks if client-side execution boundaries are secured. This helps protect your users against unauthorized scripts, framing attacks, session hijacking, and cross-site scripting vulnerabilities.

Cross-Origin Resource Sharing (CORS) is a browser sandboxing security mechanism that prevents web applications from requesting resource headers from arbitrary third-party domains. Because of these strict browser-side sandbox boundaries, an online client-side tool cannot query a remote domain's headers directly without using a server-side proxy. Paste auditing provides a 100% private, browser-based alternative that processes header metadata locally without transmitting raw network requests.

Content-Security-Policy (CSP) is a powerful HTTP header that restricts where the browser is allowed to load resources like scripts, stylesheets, and images from. A secure CSP should be structured with strict, explicit directives such as default-src 'self' and avoid unsafe exceptions like 'unsafe-inline' or 'unsafe-eval'. Whitelisting trusted CDN hosts or using cryptographic nonces ensures that even if an attacker manages to inject a malicious script tag, the browser will refuse to execute it.

Strict-Transport-Security (HSTS) is a security directive that forces browsers to only communicate with your domain using secure HTTPS connections. It mitigates SSL-stripping attacks, where a malicious actor intercepts traffic and downgrades connection protocols to unencrypted HTTP. By implementing HSTS with a long max-age (e.g. 31536000 seconds or one year) and appending includeSubDomains; preload, you guarantee that all visitors are protected from unencrypted packet sniffing.

Clickjacking is a visual exploit where an attacker overlays an invisible iframe containing your website on top of a malicious page, tricking users into clicking buttons or typing credentials. The X-Frame-Options: DENY (or SAMEORIGIN) header directs the browser to block any framing of your webpage. The modern alternative is the CSP frame-ancestors directive, which provides fine-grained control, letting you specify exactly which domains are authorized to embed your page assets.

The X-Content-Type-Options: nosniff header blocks browsers from "MIME sniffing" or guessing the content type of a file based on its actual payload rather than the declared Content-Type header. If this directive is missing, an attacker could upload a malicious script disguised as a harmless image or text file, and the browser might execute it anyway. Forcing the browser to strictly follow the declared content type closes this critical client-side attack vector.

Yes, pasting headers into our local auditor is completely secure and private because all processing runs 100% locally in your browser's RAM. However, when inspecting production responses, it is a best practice to sanitize any sensitive cookies, authentication tokens (like Bearer or JWT), or unique session identifiers from the pasted text. Auditing only the structural configuration directives ensures you evaluate domain security without exposing user authentication data.