Security Header Analyzer
Enter a URL to see which commonly recommended security headers (CSP, HSTS, X-Content-Type-Options and more) are present, with a plain-language explanation of what each one does. This is an educational check, not a complete security audit.
How to use
- Enter a URL and submit — the request is made from the server (not your browser), since browsers block cross-origin header inspection.
- Each checked header shows whether it's present, its value, and what it does.
- Only http:// and https:// URLs on default ports are accepted; requests to private or internal addresses are blocked.
Understanding the output
This checks for the presence of commonly recommended security headers and explains what each one does. It is not a complete security audit — headers are one layer of defense among many, and a site can be reasonably secure without every header listed here, or have all of them and still have other vulnerabilities.
Common issues & tips
- •"This host resolves to a private or reserved IP address": the target blocks requests to internal/private networks, localhost and cloud metadata endpoints for security reasons — this is intentional and can't be disabled.
- •"Request timed out": the target server took too long to respond (5 second limit) or is unreachable.
Frequently asked questions
- Why is this a server-side tool instead of running in my browser?
- Browsers block JavaScript from reading most response headers on cross-origin requests (CORS). Checking another site's headers requires the request to come from a server.
- Is this a complete security audit?
- No. It checks for the presence of commonly recommended headers and explains what each does. A site can be reasonably secure without every header here, or have all of them and still have other vulnerabilities.
- Can I check internal or private URLs?
- No. Requests to localhost, private IP ranges and cloud metadata endpoints are blocked for security reasons — this can't be disabled.
Related tools
Related guides
Deploying a Production Node.js API with Docker and Nginx
A production-grade guide to deploying a Node.js API with Docker and Nginx: a hardened multi-stage Dockerfile, a database-aware health check endpoint, Docker Compose replicas vs PM2, free TLS via Certbot, and a GitHub Actions pipeline that redeploys without dropping requests.
Enterprise Strict Content Security Policy (CSP): The Production Guide for Next.js & Modern Web Apps
Production guide for implementing Strict Content Security Policy (CSP) with cryptographic nonces, 'strict-dynamic', Next.js App Router streaming SSR, and violation reporting.