X-RAY // WEB // HEADERS

SECURITY HEADERS
CHECK.

Check CSP, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy and COOP on the site response, with starting values.

Runs only this check. For all 33 checks at once, use the full Domain X-Ray. Public lookups only; nothing is stored on the server.

HEADERS

Security headers

WAITING

Enter a domain above to run this check.

01 // WHAT THE CHECK VERIFIES

What the check verifies

Checks the protection headers of the response: CSP, X-Content-Type-Options, frame protection, Referrer-Policy, Permissions-Policy and COOP.

02 // WHY IT MATTERS

Why it matters

They reduce the impact of XSS, clickjacking and data leaks to third parties. Each missing one is one layer fewer.

03 // HOW TO READ THE RESULT

What each result means

OK: At most one of the 6 protection headers is missing.
WARNING: Two or more headers are missing; the fix brings a starting value for each one.

ERROR and TIMEOUT mean the query did not finish (the source was down or slow), not a problem with the domain: run the check again.

04 // HOW TO FIX

How to fix

Starting values. Test the CSP first with Content-Security-Policy-Report-Only, so it does not break the scripts and styles of the site:

Content-Security-Policy: default-src 'self'; frame-ancestors 'none'
X-Content-Type-Options: nosniff
Referrer-Policy: strict-origin-when-cross-origin
Permissions-Policy: camera=(), microphone=(), geolocation=()
Cross-Origin-Opener-Policy: same-origin

Would rather have someone else do it? Bit Happens can fix this →

05 // CONTINUE

More checks in Website and HTTPS

Open in HTTP & HTTPS →

Full Domain X-Ray: all 33 DNS, email, HTTPS, certificate and reputation checks at once →