HTTP Security Headers Checker

Processing: API. Processed by cent-ai's API: sent to our server, held in memory, never stored.

Enter a domain to check its security-relevant response headers, with clear findings and remediation guidance. Nothing you enter here is stored or logged.

How to use it

  1. Enter a domain, e.g. example.com — no need to type https://.
  2. Select “Run check” to fetch and analyze the root endpoint’s headers.
  3. Review findings, then expand “Header-by-header details” for the full picture.

Example

Select “Use example” above to load a sample domain.

Privacy and security

  • The domain is sent to our API only to fetch its headers; it is never persisted or logged.
  • Only the root endpoint is requested — this is not a crawler.
  • Private, loopback, link-local, and other reserved IP ranges are blocked (same SSRF protection as the HTTP Header Inspector).
  • The response body is never read, stored, or returned.

Limitations

  • Checks the HTTPS root endpoint only — not every path on the site.
  • Up to 5 redirects are followed; further redirects return an error.
  • Does not execute JavaScript, so a CSP delivered only via a <meta> tag is not seen.

FAQ

Which headers does it check?

Strict-Transport-Security, Content-Security-Policy, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, clickjacking protection (CSP frame-ancestors or X-Frame-Options), Cross-Origin-Opener-Policy, Cross-Origin-Resource-Policy, and Cross-Origin-Embedder-Policy.

Is a missing header always a vulnerability?

No. Some headers are context-dependent — Cross-Origin-Resource-Policy and Cross-Origin-Embedder-Policy are marked "not applicable" rather than "missing" when absent, since they're only relevant for certain cross-origin setups.

Does it crawl the site or test multiple pages?

No — only the root endpoint of the domain you enter, once. This is not a crawler.

How is this different from the HTTP Header Inspector?

The HTTP Header Inspector shows the raw headers for any URL. This tool checks a domain's root endpoint specifically for security-relevant headers and explains what's missing or misconfigured.