Defensive HTTP Inspection
Security Header Analyzer
Evaluate your application's defensive HTTP response headers against current industry best practices.
Use ResponsiblyPassive Analysis
Only assess domains or URLs you own or have explicit authorization to test. This tool is intended solely for defensive security analysis, posture auditing, and authorized assessment.
Data Collected: Public HTTP response headers returned by the remote web server. No state modifications or vulnerability exploitation.
Non-Destructive: No exploitation, brute-forcing, or state-altering requests are performed.Responsible Use Policy
Hardening Configurations
# /etc/nginx/conf.d/security-headers.conf
add_header X-Content-Type-Options "nosniff" always;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; object-src 'none';" always;Community Supported Free Tooling
Find Security Header Analyzer helpful? Buy me a coffee!
All tools run without ads, telemetry tracking, or paid subscriptions. If this saved you time during an incident triage, header audit, or threat hunt, a small coffee contribution helps keep the servers alive and fuels new tool development.