Skip to main content
Ian Job
Back to all tools
Defensive HTTP Inspection

Security Header Analyzer

Audit individual or full HTTP response headers against defense-in-depth security standards. Evaluates the 6 essential defensive headers with actionable remediation context.

Use ResponsiblyPassive Analysis

Only assess domains, URLs, or pasted response headers you own or have explicit authorization to test. This tool is intended solely for defensive security analysis, posture auditing, and authorized assessment.

Data Collected: Public HTTP response headers returned by the remote web server, or locally pasted header strings. No state modifications or intrusive testing.

Non-Destructive: No exploitation, brute-forcing, or state-altering requests are performed.Responsible Use Policy
Quick tests:·

Copy-Ready Hardening Configurations

Apply these configurations to deploy all recommended defensive headers.

# /etc/nginx/conf.d/security-headers.conf
add_header X-Content-Type-Options "nosniff" always;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; object-src 'none';" always;
server_tokens off;

Related Guides

GuideWeb Security
How to Check Security Headers of a Website
Learn how to check security headers of a website using browser developer tools and terminal commands to defend against clickjacking, XSS, and MIME sniffing.
Read more
GuideWeb Security
A Practical Guide to HTTP Security Headers for Web Developers
Why modern web applications need CSP, HSTS, and X-Content-Type-Options, and how to configure them properly in Next.js and Nginx.
Read more
GuideWeb Security
How to Prevent a DDoS Attack (Step-by-Step Guide for 2026)
Protect your website infrastructure from crashing. Learn the 6 best defensive measures to block malicious traffic, implement rate limiting, and stop DDoS attacks before they cost you revenue.
Read more
GuideWeb Security
How to Protect Your Projects From Malicious npm Packages (and What GitHub's New Package Firewall Does)
GitHub launched a package firewall that blocks risky npm packages before they install. Learn how it works, who can use it and 10 steps any team can take today.
Read more