Defendoria
Talk to an ExpertRequest a Security Review

Illustration of website security protection

DEFENDORIA SECURITY TOOLS

HTTP Security Headers Analyzer

Inspect actual response headers, understand your Content Security Policy, spot configuration gaps and receive practical, developer-friendly guidance.

Analyze a website What’s included
Deep CSP reviewCookie attributesDeveloper remediation examples

FREE ADVANCED HEADER INSPECTION

Analyze your response headers

Verified HTTPS, public homepage only

Only one public HTTPS response is inspected. No credentials, web crawling, redirects or intrusive tests.

ADVANCED CHECKSCSP directivesHSTSCookie flagsCross-origin policiesClickjacking

METHODOLOGY & SCOPE

Real headers, explained for developers.

We request the public HTTPS homepage once, inspect response headers and analyze common security controls. CSP receives additional directive-level checks for script execution, frame restrictions and legacy plugin content.

Missing cross-origin isolation headers are informational unless there is a specific application need. Cookie findings identify attribute gaps but cannot determine which cookies hold sensitive data.

Frequently asked questions

Is a Content Security Policy required?

An appropriately designed CSP is strongly recommended for many web applications. A policy must match the site’s scripts, resources and integrations. A poorly tested policy can break functionality.

Why is a report-only CSP different?

A Content-Security-Policy-Report-Only header reports potential violations, but it does not enforce resource restrictions. Production enforcement requires the Content-Security-Policy header.

Should every website set COOP, COEP and CORP?

No. These are application-specific cross-origin restrictions. They can interfere with external resources or popups and should be introduced after compatibility testing.

Do all cookies need HttpOnly and SameSite?

No. Cookie purpose matters. Session cookies generally benefit from Secure, HttpOnly and appropriate SameSite settings; some browser-accessed cookies need different handling.

Does this guarantee my website is secure?

No. HTTP headers are one part of defense in depth. Code review, patching, authentication security, infrastructure and monitoring remain important.

Methodology: OWASP HTTP Security Headers · MDN CSP Guide · MDN HTTP Headers.