CSP analyzer

Paste your Content-Security-Policy header value. We grade every directive against modern best practice. No DNS lookup — bring your own header.

Examples:

Building a new policy? The security headers builder walks you through CSP, HSTS, frame-protection, and the rest of the modern stack.

Keep hardening your site

This is one check of many. Run the rest — every tool is free, no account.

Security headers scan

Grade your live response headers

TLS certificate scan

Grade chain, expiry, and key strength

Security headers builder

Emit a ready-to-paste header block

Cookie security audit

Check Secure, HttpOnly, SameSite

Mixed-content scanner

Find http:// assets on https pages

Open-redirect detector

Probe redirect params for abuse

HSTS preload checker

Grade against Chrome's preload list

CORS policy analyzer

Catch wildcard + credentials bugs