The HTTP Security Headers Checker inspects browser-facing response headers such as HSTS, Content-Security-Policy, X-Content-Type-Options, Referrer-Policy, and framing controls. Treat the result as a configuration review, not a universal security score.
What the result tells you?
Each header controls a different browser behavior. HSTS affects future HTTPS enforcement, CSP restricts allowed resource origins, X-Content-Type-Options prevents MIME sniffing, Referrer-Policy limits referrer disclosure, and frame-related policy controls embedding. A missing header is not automatically an exploitable vulnerability.
How to test safely?
Check a representative production URL and important alternate hosts such as www/non-www when they are actually served. For CSP, stage policy changes first and watch the browser console or report-only telemetry. Copying another site’s CSP can break scripts, payments, embeds, analytics, or forms.
Example output interpretation
If HSTS is absent but the site is HTTPS-only, decide whether every subdomain is HTTPS-ready before enabling includeSubDomains. If CSP is absent, first inventory the scripts/styles/frames the application legitimately needs. If a framing control is missing, determine whether embedding is intentionally supported before blocking it.
Errors and limitations
CDNs, reverse proxies, application servers, and security plugins can add or remove headers at different layers. The checker sees the final public response it received. It does not assess server patching, authorization logic, database security, dependency vulnerabilities, or whether an application is safe from XSS/CSRF by itself.