OWASP Security Headers Auditor - Audit HTTP Security Policies
Protect your web applications from clickjacking, cross-site scripting (XSS), and data leakage. Paste your website response headers to inspect active security directives recommended by OWASP guidelines.
✓ 100% Free & Unlimited
✓ 100% Browser Local & Private
✓ No Registration Required
How to use OWASP HTTP Security Headers Auditor Online
- Step 1: Paste raw HTTP response headers into the auditing box.
- Step 2: Review the generated status report checkmarks.
- Step 3: Identify missing headers and read remedial implementation tips.
- Step 4: Configure your server to append critical defense directives.
Frequently Asked Questions
What is HSTS?
HSTS (Strict-Transport-Security) forces web browsers to communicate with your website exclusively over encrypted HTTPS connections.
Why is Content-Security-Policy (CSP) critical?
CSP prevents Cross-Site Scripting (XSS) by restricting the source domains that browsers are allowed to run scripts from.