vulnbeacon_TOOLS
← All tools

Web & TLS

Security headers

Review the response headers from one authorized URL. Includes HSTS, content policies, framing protection and browser isolation.

How to use Security headersSteps, privacy & next steps

Review the browser security policies advertised by one response.

Run this check

  1. Enter the exact public HTTP or HTTPS URL you are allowed to check.
  2. Provide an operating contact and confirm current permission.
  3. Run the check, review the observed headers, and test any proposed policy change on staging.

What you need

  • A public HTTP(S) URL without credentials, query parameters or a fragment.

Your input & privacy

The target receives a bounded server-side request. Input, contact and results are processed transiently, not saved as a private assessment.

Read the result

Observed headers and contextual recommendations include remediation and verification steps. Use the CSP tool for a closer policy review.

Keep in mind

  • One response is sampled; redirects are reported without following them.
  • A missing header is not proof of an exploit. Isolation policies can affect sign-in, payments and embedded resources.

Your inputs, explained.

JWTs, source snippets, passwords, CSP text, files, hashes and Base64 are processed in browser memory. This toolkit does not upload or save those inputs.

Website checks send the approved URL to this service and contact the target. DNS checks disclose the domain to Cloudflare DNS over HTTPS. Email-breach checks send the full address to Have I Been Pwned when configured and explicitly requested.

Server checks are transient and rate limited. This application does not write tool input or result logs; your hosting provider and contacted services may retain network metadata under their own policies. Exports are saved only when you choose to download them.

Use tools only for assets you own or have permission to assess. Private scans and their saved reports use the separate authenticated VulnBeacon application.