Security header audit (demo)

https://example.com/

5/85 grade F

HTTP 200 · HTTPS yes · 2026-10-19T19:35:35.633Z

Security headers

HeaderValueTip
✖Strict-Transport-Security—Add HSTS with max-age >= 15552000
✖Content-Security-Policy—Add a CSP; avoid unsafe-inline/unsafe-eval where possible
✖X-Content-Type-Options—Set X-Content-Type-Options: nosniff
✖X-Frame-Options—Set X-Frame-Options: DENY or SAMEORIGIN (or use CSP frame-ancestors)
✖Referrer-Policy—Set Referrer-Policy e.g. strict-origin-when-cross-origin
✖Permissions-Policy—Set Permissions-Policy to limit powerful features
✖Cross-Origin-Opener-Policy—Consider COOP: same-origin
✖Cross-Origin-Resource-Policy—Consider CORP: same-origin or same-site
✔No obvious server version leakcloudflareAvoid exposing Server/X-Powered-By versions

CSP card

No CSP header

DirectiveValue
none
JSON
{
  "url": "https://example.com/",
  "finalUrl": "https://example.com/",
  "status": 200,
  "https": true,
  "score": 5,
  "max": 85,
  "grade": "F",
  "checks": [
    {
      "id": "strict-transport-security",
      "name": "Strict-Transport-Security",
      "present": false,
      "ok": false,
      "value": null,
      "tip": "Add HSTS with max-age >= 15552000"
    },
    {
      "id": "content-security-policy",
      "name": "Content-Security-Policy",
      "present": false,
      "ok": false,
      "value": null,
      "tip": "Add a CSP; avoid unsafe-inline/unsafe-eval where possible"
    },
    {
      "id": "x-content-type-options",
      "name": "X-Content-Type-Options",
      "present": false,
      "ok": false,
      "value": null,
      "tip": "Set X-Content-Type-Options: nosniff"
    },
    {
      "id": "x-frame-options",
      "name": "X-Frame-Options",
      "present": false,
      "ok": false,
      "value": null,
      "tip": "Set X-Frame-Options: DENY or SAMEORIGIN (or use CSP frame-ancestors)"
    },
    {
      "id": "referrer-policy",
      "name": "Referrer-Policy",
      "present": false,
      "ok": false,
      "value": null,
      "tip": "Set Referrer-Policy e.g. strict-origin-when-cross-origin"
    },
    {
      "id": "permissions-policy",
      "name": "Permissions-Policy",
      "present": false,
      "ok": false,
      "value": null,
      "tip": "Set Permissions-Policy to limit powerful features"
    },
    {
      "id": "cross-origin-opener-policy",
      "name": "Cross-Origin-Opener-Policy",
      "present": false,
      "ok": false,
      "value": null,
      "tip": "Consider COOP: same-origin"
    },
    {
      "id": "cross-origin-resource-policy",
      "name": "Cross-Origin-Resource-Policy",
      "present": false,
      "ok": false,
      "value": null,
      "tip": "Consider CORP: same-origin or same-site"
    },
    {
      "id": "version-leak",
      "name": "No obvious server version leak",
      "present": true,
      "ok": true,
      "value": "cloudflare",
      "tip": "Avoid exposing Server/X-Powered-By versions"
    }
  ],
  "csp": {
    "raw": null,
    "directives": {},
    "notes": [
      "No Content-Security-Policy header"
    ]
  },
  "interestingHeaders": {
    "content-type": "text/html; charset=utf-8"
  },
  "auditedAt": "2026-10-19T19:35:35.633Z"
}

← Audit another