Headers, cookies & policies
Read response headers and examine CSP, cookies, CORS, referrer and permission policies.
Explore the tools
6 focused tools, with an explanation and a practical guide for each check.
Web security
← All Website security toolsHTTP security headers
Inspect a live response for HSTS, CSP, framing rules and other browser security policies.
Server-side requestWeb securityContent Security Policy audit
Parse a pasted CSP, inspect effective fallbacks and identify permissive script policies.
Local analysisWeb securityCookie security audit
Check pasted Set-Cookie headers for Secure, HttpOnly, SameSite and cookie prefix rules.
Local analysisWeb securityReferrer-Policy analyser
Identify the effective recognised Referrer-Policy token and explain its cross-origin behavior.
Local analysisWeb securityPermissions-Policy analyser
Read feature allowlists from a pasted Permissions-Policy response header.
Local analysisWeb securityCORS header analyser
Inspect pasted Access-Control response headers for wildcard, credential and cache pitfalls.
Local analysis