安全标头检查
我们获取公共 URL 的响应标头（不含正文），并逐项检查防护性标头。
此内容尚无中文（中国）版本。在发布译文之前以英语显示。
Some of the most effective web protections are plain HTTP response headers, set once on the server. This check fetches the response headers of a public URL, following redirects to the final page, and checks them one by one:
- Strict-Transport-Security makes browsers use HTTPS only.
- Content-Security-Policy limits where scripts and other resources may load from, and with
frame-ancestorswho may frame the page. - X-Content-Type-Options: nosniff stops browsers from guessing file types.
- Referrer-Policy controls how much of the URL is passed on to other sites.
- Permissions-Policy switches off browser features the site does not use.
- Cross-Origin-Opener-Policy isolates the page from windows it opens.
It also flags software versions disclosed in Server or X-Powered-By. The result is a checklist, not a security rating: headers are one layer among many.
常见问题
Why is HSTS shorter than six months marked weak?
Browsers only remember the HTTPS requirement for max-age seconds. Six months to a year is the usual recommendation, and is required for the browsers' preload lists.
Is X-Frame-Options still needed?
The CSP frame-ancestors directive replaces it in modern browsers. Either one counts as framing protection here.
Does this tool send anything other than a normal request?
No. It sends one ordinary GET request per redirect hop, reads only the headers and closes the connection.