本文へスキップ
ipaddress.tr

セキュリティヘッダーチェック

公開URLのレスポンスヘッダー（本文なし）を取得し、保護用ヘッダーを1つずつ確認します。

例:

このテキストはまだ日本語で提供されていません。翻訳が公開されるまで英語で表示しています。

Some of the most effective web protections are plain HTTP response headers, set once on the server. This check fetches the response headers of a public URL, following redirects to the final page, and checks them one by one:

  • Strict-Transport-Security makes browsers use HTTPS only.
  • Content-Security-Policy limits where scripts and other resources may load from, and with frame-ancestors who may frame the page.
  • X-Content-Type-Options: nosniff stops browsers from guessing file types.
  • Referrer-Policy controls how much of the URL is passed on to other sites.
  • Permissions-Policy switches off browser features the site does not use.
  • Cross-Origin-Opener-Policy isolates the page from windows it opens.

It also flags software versions disclosed in Server or X-Powered-By. The result is a checklist, not a security rating: headers are one layer among many.

よくある質問

Why is HSTS shorter than six months marked weak?

Browsers only remember the HTTPS requirement for max-age seconds. Six months to a year is the usual recommendation, and is required for the browsers' preload lists.

Is X-Frame-Options still needed?

The CSP frame-ancestors directive replaces it in modern browsers. Either one counts as framing protection here.

Does this tool send anything other than a normal request?

No. It sends one ordinary GET request per redirect hop, reads only the headers and closes the connection.

関連