Security
Security Header Analyzer
Enter a URL to see which commonly recommended security headers (CSP, HSTS, X-Content-Type-Options and more) are present, with a plain-language explanation of what each one does. This is an educational check, not a complete security audit.
01
How to use
- Enter a URL and submit — the request is made from the server (not your browser), since browsers block cross-origin header inspection.
- Each checked header shows whether it's present, its value, and what it does.
- Only http:// and https:// URLs on default ports are accepted; requests to private or internal addresses are blocked.
02
Understanding the output
This checks for the presence of commonly recommended security headers and explains what each one does. It is not a complete security audit — headers are one layer of defense among many, and a site can be reasonably secure without every header listed here, or have all of them and still have other vulnerabilities.
03
Common issues & tips
- •"This host resolves to a private or reserved IP address": the target blocks requests to internal/private networks, localhost and cloud metadata endpoints for security reasons — this is intentional and can't be disabled.
- •"Request timed out": the target server took too long to respond (5 second limit) or is unreachable.
Frequently asked questions
- Why is this a server-side tool instead of running in my browser?
- Browsers block JavaScript from reading most response headers on cross-origin requests (CORS). Checking another site's headers requires the request to come from a server.
- Is this a complete security audit?
- No. It checks for the presence of commonly recommended headers and explains what each does. A site can be reasonably secure without every header here, or have all of them and still have other vulnerabilities.
- Can I check internal or private URLs?
- No. Requests to localhost, private IP ranges and cloud metadata endpoints are blocked for security reasons — this can't be disabled.