CSP Static Security Tools
Home / Security Headers Checker
Audit tool

See which response headers are missing in seconds.

Paste raw response headers from DevTools, curl -I, or your CDN dashboard and the checker will highlight what is present, what is missing, and how to fix it.

Input headers

One header per line in Header-Name: value format.

Related reading

Use these guides to act on what the audit finds.

Security headers best practices

A practical priority order for shipping CSP, HSTS, and the rest of the baseline.

See the rollout order

Security headers for static sites

Compact checklist tuned for static hosts and CDN-driven deployments.

Static site checklist

CSP Generator

Generate a copy-ready Content Security Policy with report-only, nonce, and hash helpers.

Open the generator

CSP Checker

Fetch a live URL through a proxy and inspect CSP and the other recommended headers.

Check a live URL

How to fix missing security headers

Confirm the gap, add the header in the right layer, and verify the live response.

Open the FAQ

CSP for Cloudflare Pages

Add the missing headers via _headers or Pages Functions.

Cloudflare Pages

Next step

Once the audit shows what is missing, move into the generator or live checker so the fix lands in the real response path.

Open the generator

Turn the missing header into a copy-ready policy snippet.

Generate a policy

Check a live URL

Inspect the live site if the audit came from pasted headers.

Check a live URL

Review the rollout order

Use the baseline guide to avoid fixing one header in isolation.

Read the guide

Official references

Docs that help translate an audit into a real deployment fix.

MDN: Strict-Transport-Security

Helpful when the audit flags missing transport hardening.

Read MDN

MDN: Content-Security-Policy

Reference for the header you are usually fixing first.

Read MDN

W3C CSP Level 3

The spec behind CSP-related audit findings.

Open the spec