Check before launch
Security Headers and CORS Checker
This local HTTP header checker reviews pasted response headers for common browser-security omissions, permissive CORS signals, framing protection and missing cookie attributes.
Local analyzer: Runs entirely in this browser. Headers stay in your browser.
Synthetic example, not a configuration recommendation for every route.
Sample result
An example of the output shape, not a result from your input:
2 headers missing · Content-Security-Policy and Referrer-Policy
Run this on your whole app
This check covered only what you pasted or selected here. A free trial lets you authorize a repository, live URL or API, run the checks available for your authorized target and plan and keep one launch report you can share.
Start free trialRelated tools
Most reviewers run two or three of these together. Each runs in your browser and states what it cannot prove.
See all free toolsWhat this checks
- Presence of CSP, HSTS, X-Content-Type-Options, Referrer-Policy and Permissions-Policy
- X-Frame-Options or a CSP frame-ancestors directive
- Wildcard CORS signals and Secure, HttpOnly and SameSite cookie attributes
What this cannot prove
- It does not fetch your URL or observe redirects, preflight requests or route-specific behavior
- It checks a focused set of names and patterns, not whether every policy value is safe
- A clear result does not establish exploitability or overall application security
Primary references
Use these standards and vendor references when you investigate a result. A link does not imply certification or full coverage of the source.
Frequently asked questions
Does this upload my input?
Headers stay in your browser.
Does a clear result mean my app is secure?
No. Each result is limited to the checks shown here. Use it as a next-step guide, then test the relevant application path.