How this check works
The scanner reads headers from the final permitted website response. It checks HSTS max-age, the nosniff value and recognized referrer policies; CSP and Permissions Policy receive presence checks, not a complete policy audit. Investigate warnings with the developer responsible for the site.
Read the final response
We inspect the final page after permitted redirects, preferring HTTPS. CDN rules, error pages and different paths can return different policies. This tool checks the normalized domain's root page.
Deploy policies gradually
A strict CSP can break scripts, payments or embedded content if its allowlist is incomplete. Test policy changes against the site's real functions; a header's presence does not guarantee a safe policy.
Common questions
Is CSP Report-Only enough to pass?
Report-Only helps test a policy but does not enforce it. This check looks for the enforcing Content-Security-Policy header.
Why is max-age=0 a warning?
An HSTS value of zero removes the browser's stored HSTS policy instead of enabling ongoing HTTPS protection.