HeaderScan.dev
Tools

Tools

HeaderScan.dev RedirectPath.dev CheckSSL.dev SiteAudit.dev

Illustrative example

HTTP headers example report

Warning

https://demo.example/guides/tls?lang=[redacted]

This is a permanent example with fictional data for demo.example. No scan runs when you open this page. Dates, timings and results are illustrative.

A page returns HTTPS headers and a secure session cookie, but its CSP is Report-Only and one header is duplicated. Open the findings to compare observations, advice and scoring.

What to do next: Review the CSP in Report-Only before enforcing it, identify the layer adding the duplicate header and verify the final deployed response.

Scan headers How this tool works

Final response

Headers from the final HTTP response.

Header score

86 / 100

Final HTTP status
HTTP 200
Redirects followed
0 · up to five
Final URL
https://demo.example/guides/tls?lang=[redacted]

Security

  • HTTPS

    Passed

    The final response uses HTTPS.

    Details

    HTTPS encrypts data in transit. This check is not a full TLS audit.

    Redirect visitors to HTTPS and use a valid certificate.

    Confirm that the final resource uses HTTPS, then test the HTTP entry URL and its destination.

    Guide: Security headers Quick reference

  • HSTS

    Warning

    HSTS found. Checked max-age and duplicate headers.

    Details

    Browsers only accept HSTS over HTTPS. A max-age of zero disables it; short durations offer less protection.

    Use one HSTS header over HTTPS with max-age of at least 15552000. Include subdomains only if they all support HTTPS.

    Review the HTTPS endpoint and every subdomain before extending HSTS coverage. A browser remembers the policy for its declared lifetime.

    Guide: Security headers Quick reference

  • Content-Security-Policy

    Warning

    No enforced CSP received.

    Details

    Checks script/default sources for permissive tokens. Source trust and full browser syntax are not assessed. Report-Only policies do not enforce restrictions.

    Restrict scripts with script-src or default-src. Avoid wildcard, unsafe-inline and unsafe-eval. Use nonces or hashes where needed.

    Review script dependencies and browser violations before enforcing a stricter policy. This finding checks received script-source tokens, not application exploitability.

    Guide: CSP implementation Quick reference

  • X-Content-Type-Options

    Not checked

    Checked the nosniff configuration.

    Details

    nosniff prevents browsers from guessing content types. Duplicate headers make the configuration ambiguous.

    Send one X-Content-Type-Options: nosniff header and the correct Content-Type.

    This measurement is incomplete. Use the explanation to check the outcome independently.

    Check the response Content-Type alongside nosniff, including public assets and error responses.

    Guide: Security headers Quick reference

  • Referrer-Policy

    Passed

    Checked the last recognized referrer policy.

    Details

    A permissive policy may share path and query data with other sites. Browser defaults may already offer protection.

    Choose no-referrer or strict-origin-when-cross-origin to suit the site.

    Choose how much URL information the browser should share, then verify the deployed policy.

    Guide: Security headers Quick reference

  • Permissions-Policy

    Info

    Permissions-Policy found; values are redacted.

    Details

    Required browser features vary by site. Presence does not prove a safe configuration; this check is not scored.

    Disable unused features such as camera, microphone and location where appropriate.

    Review the browser features and cross-origin journeys this page actually needs. An informational result does not establish a safe policy.

    Guide: Security headers Quick reference

  • Framing protection

    Passed

    Checked X-Frame-Options.

    Details

    A restrictive frame-ancestors policy can replace X-Frame-Options. A wildcard does not provide general framing protection.

    Use CSP frame-ancestors with trusted sources, or X-Frame-Options: DENY / SAMEORIGIN.

    List the parents allowed to embed this page before choosing frame-ancestors or X-Frame-Options.

    Guide: Security headers Quick reference

  • Cross-Origin-Opener-Policy

    Info

    Header missing.

    Details

    Suitable isolation depends on pop-ups and external resources. This check is not scored.

    Check which cross-origin interactions the site needs.

    Review the browser features and cross-origin journeys this page actually needs. An informational result does not establish a safe policy.

    Guide: Security headers Quick reference

  • Cross-Origin-Resource-Policy

    Info

    Header missing.

    Details

    Suitable isolation depends on pop-ups and external resources. This check is not scored.

    Check which cross-origin interactions the site needs.

    Review the browser features and cross-origin journeys this page actually needs. An informational result does not establish a safe policy.

    Guide: Security headers Quick reference

  • CORS configuration

    Info

    No Access-Control-* headers received.

    Details

    No controlled Origin or preflight was sent. CORS security was not assessed.

    Test allowed and denied Origins and preflight separately.

    Test allowed and denied Origin requests and preflights separately. This scan did not perform a full CORS test.

    Guide: Security headers Quick reference

Cookies

  • Cookie 1 · Secure

    Passed

    Secure found.

    Details

    Secure restricts transmission to HTTPS.

    Use HTTPS and set Secure on this cookie.

    Review this cookie’s purpose and the flows that depend on it. A public response does not show every cookie created after sign-in or by JavaScript.

    Guide: Cookies Quick reference

  • Cookie 1 · HttpOnly

    Passed

    HttpOnly found.

    Details

    Session cookies should usually be HttpOnly. Cookies intentionally read by JavaScript may be an exception.

    Set HttpOnly when JavaScript does not need the cookie.

    Review this cookie’s purpose and the flows that depend on it. A public response does not show every cookie created after sign-in or by JavaScript.

    Guide: Cookies Quick reference

  • Cookie 1 · SameSite

    Passed

    SameSite=Lax.

    Details

    SameSite restricts cross-site transmission. None requires Secure and may be needed for external integrations.

    Choose Lax or Strict explicitly. Use None with Secure only when cross-site transmission is needed.

    Review this cookie’s purpose and the flows that depend on it. A public response does not show every cookie created after sign-in or by JavaScript.

    Guide: Cookies Quick reference

  • Cookie 1 · Domain

    Passed

    Host-only cookie without Domain.

    Details

    Without Domain, the cookie stays on the current host. Browsers reject mismatched Domain values.

    Omit Domain unless sharing with subdomains is necessary.

    Review this cookie’s purpose and the flows that depend on it. A public response does not show every cookie created after sign-in or by JavaScript.

    Guide: Cookies Quick reference

  • Cookie 1 · Path

    Info

    Path is set; the value is redacted.

    Details

    Path controls where the cookie is sent, but is not a security boundary.

    Use a valid path that matches the purpose of the cookie.

    Review this cookie’s purpose and the flows that depend on it. A public response does not show every cookie created after sign-in or by JavaScript.

    Guide: Cookies Quick reference

  • Cookie 1 · Expires / Max-Age

    Info

    Session cookie without an explicit lifetime.

    Details

    Session cookies are allowed. The appropriate lifetime depends on their purpose; values are not stored.

    Choose the shortest suitable lifetime and use a valid Max-Age or Expires.

    Review this cookie’s purpose and the flows that depend on it. A public response does not show every cookie created after sign-in or by JavaScript.

    Guide: Cookies Quick reference

Caching

  • Cache-Control

    Passed

    Explicit cache directives found.

    Details

    Missing cache headers are not always an error. Personal data may need no-store or private. Set-Cookie alone does not prevent shared caching.

    Choose an explicit policy for the content. no-cache allows storage with revalidation.

    Match the policy to public, personalized or sensitive content and inspect any CDN overrides. A public scan cannot verify a signed-in response.

    Guide: Caching Quick reference

  • ETag / Last-Modified

    Passed

    Revalidation header found. Identifying values are redacted.

    Details

    Validators save bandwidth on revalidation. They are not needed with no-store and may be intentionally omitted.

    Use a validator for content that browsers may store and revalidate.

    ETag and Last-Modified support conditional requests. Check that a changed resource gets a new validator and that an unchanged resource can be revalidated correctly.

    Guide: Caching Quick reference

  • Vary

    Info

    Not scored

    Vary found.

    Details

    Vary distinguishes response variants. A specific CORS Origin may require Vary: Origin. This is not a full CORS test.

    Use Vary: Origin when Access-Control-Allow-Origin varies by request.

    Compare requests with different values for fields that select a response variant, such as Origin or Accept-Encoding. Check that the CDN includes the intended variation in its cache behavior.

    Guide: Caching Quick reference

  • CDN hints

    Info

    No known CDN hints received.

    Details

    CDN hints do not prove that personal content is cached safely. Unknown values are redacted.

    Check CDN cache settings for personal responses.

    Compare repeat requests and the cache evidence returned by the edge. Review CDN rules alongside Cache-Control; an edge header alone does not reveal all stored variants.

    Guide: Caching Quick reference

Server information

  • Product and version headers

    Passed

    Product information found, with no recognizable version.

    Details

    Product or version details do not prove a vulnerability, but can identify the software in use.

    Remove unnecessary version headers and keep software up to date.

    Compare a successful page with the response shown here and review unnecessary implementation details. This is not a vulnerability diagnosis.

    Guide: Security headers Quick reference

  • Server information

    Info

    Server information is redacted in All headers.

    Details

    Only known product names and versions remain visible. Other values may contain sensitive data.

    Limit server information to what is operationally necessary.

    Compare a successful page with the response shown here and review unnecessary implementation details. This is not a vulnerability diagnosis.

    Guide: Security headers Quick reference
How is this score calculated?

Base weights: security 55, cookies 20, caching 15 and server information 10. Cookie weights are divided equally. Only applicable pass, warning and fail checks count; other weights are redistributed to total 100. A pass earns full points, a warning half and a failure zero. The final score is rounded; individual points use two decimal places.

  • HTTPS10.99 / 10.99 points
  • HSTS5.49 / 10.99 points
  • Content-Security-Policy8.24 / 16.48 points
  • X-Content-Type-OptionsNot counted
  • Referrer-Policy5.49 / 5.49 points
  • Permissions-PolicyNot counted
  • Framing protection8.79 / 8.79 points
  • Cross-Origin-Opener-PolicyNot counted
  • Cross-Origin-Resource-PolicyNot counted
  • CORS configurationNot counted
  • Cookie 1 · Secure8.79 / 8.79 points
  • Cookie 1 · HttpOnly4.40 / 4.40 points
  • Cookie 1 · SameSite6.59 / 6.59 points
  • Cookie 1 · Domain2.20 / 2.20 points
  • Cookie 1 · PathNot counted
  • Cookie 1 · Expires / Max-AgeNot counted
  • Cache-Control10.99 / 10.99 points
  • ETag / Last-Modified3.30 / 3.30 points
  • VaryNot counted
  • CDN hintsNot counted
  • Product and version headers10.99 / 10.99 points
  • Server informationNot counted
All headers

Sensitive and unknown values are redacted.

content-type: text/html; charset=utf-8
strict-transport-security: max-age=86400
content-security-policy-report-only: [redacted]
x-content-type-options: nosniff
x-content-type-options: nosniff
x-frame-options: DENY
referrer-policy: strict-origin-when-cross-origin
permissions-policy: [redacted]
set-cookie: [redacted]
cache-control: private, no-cache
etag: [redacted]
vary: Accept-Encoding
server: nginx

About this scan

Checks the final response after up to five redirects: security, cookies, caching and server information. Does not run JavaScript or send cookies.

This fixed example is public and does not expire. It contains fictional data, not a stored visitor scan.

A snapshot, not a security guarantee.

Read the methodology and report data policy