Controls which scripts, styles, images and other resources a page may load.
Web security
HTTP security headers checker
Inspect the final response from a public website and see which common browser security headers are present.
Quick guide
What these headers actually tell you
Security headers let a website ask the browser to enforce protections around content loading, framing, referrer data, browser capabilities and HTTPS usage.
A missing header is not automatically a vulnerability, and some advanced cross-origin headers deliberately are not appropriate for every site. IPGetter shows what is present and explains the purpose without pretending there is one perfect configuration.
Tells browsers to keep using HTTPS for a host after a secure visit.
X-Frame-Options or CSP frame-ancestors can restrict who may embed a page.
The final HTTP response headers are inspected for commonly used browser security controls. Presence is reported separately from whether a policy is suitable for a specific site.
- Spotting missing baseline security headers
- Reviewing a deployment after a configuration change
- Checking what browsers are actually being told