Security Headers Checker
Inspect allowlisted security-related headers on a bounded public HTTP response.
Run Security Headers Checker
Public targets only. No credentials, changes or anonymous active security testing.
What this check does
- Public response snapshot
- Allowlisted security headers
- Validated redirect destinations
What it does not prove
- No application exploitation
- No authenticated response testing
- Header presence does not establish policy effectiveness
Interpret the returned state
PASS means the endpoint returned evidence within its named boundary. REVIEW, WARN and FAIL must be read alongside that evidence; they are not automatically vulnerabilities. UNKNOWN means the observation could not establish the answer.
Why it matters
Headers give browsers instructions. The right policy depends on the application; adding every header indiscriminately can break legitimate behaviour.
Common review questions
- A supported header may be absent from the observed response.
- A present CSP still needs application-specific review.
- Different routes and authenticated responses can have different controls.
Use header evidence as configuration context
Record the final URL and response observed. A redirect or error response may not represent the application page you intended to review.
Read the actual header values, not just a count. HSTS scope and CSP directives should match deployment needs. Cookie values are redacted by the API.
Do not claim a vulnerability from presence or absence alone. A scoped application review can establish which changes are appropriate.
Read the related technical guide →When a fuller review would help
ZENQIX can combine relevant observations, explain priorities and recommend next steps. No automatic remediation, penetration test or complete-security guarantee is included.
Explore Security & Exposure ReviewFrom ₹9,999