Security Headers Analyzer

Controls which resources the browser is allowed to load. Prevents XSS and data injection attacks.

Forces browsers to use HTTPS. Prevents protocol downgrade attacks and cookie hijacking.

Prevents browsers from MIME-sniffing a response away from the declared content type.

Prevents clickjacking by controlling whether the page can be embedded in iframes.

Controls how much referrer information is included with requests. Prevents leaking sensitive URLs.

Controls which browser features (camera, microphone, geolocation, etc.) are allowed.

Legacy XSS filter (now deprecated in modern browsers in favor of CSP). Still useful for older browsers.

Isolates the browsing context to prevent cross-origin attacks like Spectre.

Prevents other origins from loading your resources. Protects against Spectre-like attacks.

Controls whether the document can load cross-origin resources without explicit permission.