Fetches the HTTP response for your URL and lists common security headers. HTTPS is used by default when you omit the scheme.
These response headers were not found on the final URL. They are common hardening measures - not mandatory for every site.
Headers are one layer of defence. They do not replace secure coding, patching or TLS configuration.
Many headers tell browsers how to handle your content - framing, MIME sniffing, referrer leakage and feature access - without changing HTML.
A missing header is not always a vulnerability. Marketing sites, SPAs and embedded widgets each need different CSP, COOP and CORP choices.
Run the same URL on staging and production to spot missing HSTS, CSP or X-Content-Type-Options before go-live.
When you submit a URL, Compathub’s server requests it over HTTP(S), follows redirects (up to five hops), and reads the response headers on the final response. You get a structured list of nine security-related headers the checker knows about, plus plain-language notes - not a penetration test, malware scan, or review of your HTML, cookies, or TLS cipher suites.
HTTPS is assumed if you omit the scheme. Private networks, localhost, and Compathub’s own domain are blocked for safety.
| Header | What it influences |
|---|---|
| Strict-Transport-Security | Tells supporting browsers to use HTTPS only for your site for a period. Only meaningful on HTTPS responses. |
| Content-Security-Policy | Restricts where scripts, styles, images and other resources may load from - must match your real stack. |
| X-Content-Type-Options | Often nosniff to reduce MIME-type sniffing. |
| X-Frame-Options | Limits framing/embedding in other sites (clickjacking mitigation). CSP frame-ancestors is the modern counterpart. |
| Referrer-Policy | Controls how much referrer URL is sent on navigations and requests. |
| Permissions-Policy | Allows or denies browser features (camera, geolocation, payment, etc.) on your pages. |
| Cross-Origin-Opener-Policy | Isolates your window from cross-origin documents - relevant for advanced apps. |
| Cross-Origin-Resource-Policy | Signals who may load this resource cross-origin; can affect CDNs and embeds. |
| Cross-Origin-Embedder-Policy | Part of cross-origin isolation for advanced APIs; requires coordinated CORP/CORS setup. |
A missing header is a finding to investigate, not proof that your site is unsafe. Many sites operate without every optional header. A present header can still be misconfigured (overly permissive CSP, HSTS with wrong max-age, CORP that breaks a partner widget).
Use the in-tool recommendations as starting points. Compare staging and production URLs when you are preparing a launch.
CSP is not one-size-fits-all. Pasting a strict policy from another site can break checkout, analytics, or embedded videos. A practical path is to deploy Content-Security-Policy-Report-Only first, watch reports, then tighten. See MDN’s CSP guide for directive reference.
nosniff, sensible Referrer-Policy, framing rules that match embedding needs).Is more headers always better? No - only headers you understand and maintain.
Why differs from Chrome DevTools? This tool checks one server-side GET to the URL you enter, not subresources, service workers, or your local cache.
Does this guarantee security? No. Headers are one layer; patching, auth, and secure coding still matter.
If the URL redirects first, inspect the chain with the Redirect Checker, then check headers on the final URL you intend to serve. Measure total elapsed time with the Website Response Time Checker. Confirm the TLS certificate for the hostname with the SSL Certificate Checker. To see CMS or CDN clues in the HTML, try the Website Stack Checker on that same final URL. For PTR names on the server IP, use Reverse IP Lookup after confirming addresses with DNS Lookup.