PermitANY
Tool · Security

HTTP Headers Checker

Request a host over HTTPS or HTTP and read the status code, the final URL after redirects, the response time and every header the server returned — with the six security headers audited separately as set or missing.

What this result does not prove

  • These are the last hop's headers, not the first hop's. Redirects are followed, and the URL under the status code is where the chain ended. Ask for http:// on a site that redirects and you read the HTTPS response, while the redirect itself — what matters for a downgrade attack — stays invisible. HSTS on a redirect is pointless too, since a browser ignores the header over plain HTTP: a site can look HSTS-protected here while every new visitor's first request is unprotected. Request both forms separately and compare.
  • "Set" is not "good". The audit checks presence, because presence is all a header fetch can check. A Content-Security-Policy with unsafe-inline and unsafe-eval permits what CSP exists to prevent and still shows as set; an HSTS header with max-age=0 switches HSTS off. Read the value, not the word in the left column.
  • One request, from one place, to one of your servers. The fetch comes from PermitANY's server, so you see what the nearest CDN edge serves it. A WAF may treat a datacentre request differently from a browser; a header set on one origin and not another is a coin flip behind a load balancer; per-route headers mean the homepage is not the API. A missing header here is real; a present one is present on this path.
  • The timing is not a performance measurement. The milliseconds cover DNS, connection, TLS and the full body of one cold GET from one location. It tells you the server answered. It is not a latency figure for your users.

The six headers in the audit

Strict-Transport-SecurityForces HTTPS for this host for max-age seconds, including the first click of a typed hostname once the host is known
Content-Security-PolicyDeclares which origins may supply scripts, styles and frames — the structural defence against injected script
X-Content-Type-Optionsnosniff — stops the browser second-guessing a Content-Type and executing an upload as script
X-Frame-OptionsDENY or SAMEORIGIN — stops the page being framed, which is what makes clickjacking possible
Referrer-PolicyControls how much of the current URL is sent as the referrer to other sites
Permissions-PolicySwitches off features the page does not use — camera, microphone, geolocation
  • Two are structural, four are one line each. Content-Security-Policy takes real work — a policy strict enough to help will break a page not written for it — and it is the only one that mitigates a whole class of bug rather than a single trick. The cheap four carry essentially no deployment risk, which is why a site missing them is usually a site nobody has looked at.
  • HSTS is the one with a lasting side effect. A long max-age with includeSubDomains commits every subdomain to HTTPS for that long, and a subdomain that cannot do HTTPS is unreachable until the header expires from each visitor's browser.
  • Three headers outside the audit matter as much. Server and X-Powered-By volunteer version information nobody needs; on Set-Cookie, a missing Secure, HttpOnly or SameSite is more consequential than any of the six above; and Cache-Control on anything authenticated, because a cacheable private response is a disclosure waiting for a shared proxy.

When to use something else

For the TLS underneath the headers — certificate, chain, negotiated protocol — use the SSL checker, and for a judgement on the configuration rather than a reading of it, the tls-configuration-review prompt. To go past headers into the application, web-app-scanner covers many hosts and more than the response head, and ssl-cert-checker watches expiry across an estate on a schedule.