Content-Security-Policy (CSP)
Restricts which scripts, styles, frames and other resources a browser may load. A carefully tested CSP can reduce the impact of cross-site scripting.
Content-Security-Policy: default-src 'self'
DeployPass / Security Headers Checker
Free · No signup · Passive public check
Free Security Headers Checker
Check the browser-facing security headers on any public website. Review CSP, HSTS, MIME sniffing protection, Referrer-Policy, clickjacking controls, CORS and cookie security signals in seconds.
DeployPass performs passive checks only. It does not attempt exploitation, credential testing, or port scanning.
Checking public response headers…
HEADER SCORE
—/100
REVIEWSecurity header review
0Passed
0Warnings
0Critical
0N/A
Need the complete pre-deployment review?
Run full DeployPass scan →Run all 19 DeployPass checks for frontend exposure, source maps, mixed content, framework disclosure and more.
What this tool checks
Important browser security controls, explained.
Security headers tell browsers how to handle content, framing, transport and referrer data. A missing header is not automatically a vulnerability, but weak or absent controls can make common web attacks easier.
Strict-Transport-Security (HSTS)
Tells compatible browsers to use HTTPS for future requests after a secure connection has been established.
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options
The nosniff value tells browsers not to reinterpret declared MIME types in ways that can create security problems.
X-Content-Type-Options: nosniff
Clickjacking protection
Use CSP frame-ancestors or, where appropriate, X-Frame-Options to control whether another site may frame your pages.
Content-Security-Policy: frame-ancestors 'none'
Referrer-Policy
Controls how much referrer information the browser sends when users navigate away or load cross-origin resources.
Referrer-Policy: strict-origin-when-cross-origin
CORS & cookie signals
DeployPass also reviews obvious CORS behavior and Secure, HttpOnly and SameSite signals when cookies are observable on the scanned response.
How to use the result
Fix warnings in context, not by checkbox.
A strong header configuration depends on the application. For example, an overly strict CSP can break legitimate scripts, and HSTS should normally be enabled only after HTTPS is stable across the intended hostnames. DeployPass reports observable signals and gives practical starting points rather than claiming that one header set makes a site secure.
FAQ
Security headers checker FAQ
What are HTTP security headers?
They are HTTP response headers that instruct browsers to apply security-related behavior, such as enforcing HTTPS, limiting framing, controlling referrer information or restricting allowed content sources.
Does a perfect header score mean my website is secure?
No. Security headers cover only part of a web application's security posture. Server-side authorization, dependency vulnerabilities, authentication, business logic and database controls require other forms of review.
Why can a cookie check show N/A?
The scanned public response may not set a cookie. DeployPass reports N/A when a condition was not observable instead of treating it as a pass.
Does DeployPass perform a penetration test?
No. This tool performs passive public-surface checks and does not attempt exploitation, credential attacks or port scanning.
What else does the full DeployPass scan check?
The full scan adds checks for mixed content, source map exposure, frontend secret-like patterns, public environment-variable names, framework disclosure, verbose errors and other deployment signals.