Inspect before you configure

Check the final response after redirects. A header configured on the origin may be removed, replaced or duplicated by a reverse proxy or CDN.

See what browsers receive

Review response metadata and six common browser protections.

Check headers

Begin with low-risk protections

X-Content-Type-Options: nosniff prevents MIME sniffing. A deliberate Referrer-Policy limits information sent on outbound requests. Permissions-Policy can disable browser capabilities the site does not use.

Treat HSTS as a commitment

Strict-Transport-Security tells browsers to use HTTPS for a period of time. Confirm HTTPS works across every affected hostname before adding subdomains or requesting preload.

Deploy Content Security Policy gradually

CSP can significantly reduce script injection risk, but a strict policy can also break legitimate scripts, styles and frames. Start with reporting, observe violations, then enforce a policy matched to the application.

Choose one frame-control strategy

frame-ancestors in CSP is the modern, flexible control. X-Frame-Options remains useful for older clients. Decide whether embedding is forbidden or allowed only for known origins.

Presence is not correctness.

A header checker can confirm that a value is returned. Its policy still needs review against the site’s real scripts, integrations and threat model.