Security headers and trust boundaries
Review supplied response security headers locally, preserving CSP policy boundaries and explicit limits without uploading headers or issuing a security score.
Review one response without uploading it
Paste response fields from an application you own or are authorised to inspect. Copy Name: value lines, preserving duplicate fields. An initial HTTP status line is optional. Remove cookies, credentials and unrelated fields before pasting.
This is a local structural review, not a website scan, preflight test or security score. The tool cannot retrieve another site’s headers or confirm that a browser enforced them.
Limit: 32 KiB, 128 fields, 16 CSP policies. Folded fields, multiple responses, bodies and HTTP/2 pseudoheaders are not supported. No input is stored, logged or uploaded by this tool.
Limits of this review
Several CSP policies can apply together; report-only policies do not enforce blocking. Source-expression validity and the application’s actual request contexts need browser testing. Parameterized COOP, COEP and CORP forms are marked not evaluated in this version. A report can be analysed while containing invalid fields or missing evidence.
HSTS cache and preload state, certificate trust, actual CORS access, frame ancestors, document meta policies, Permissions Policy and crossOriginIsolated are not tested. Do not treat absent headers as a universal defect or apply stricter policies without checking application behavior.