Toolkit

Security Headers Check

Six response headers that cost nothing to set and stop entire categories of attack. This grades what your site currently sends and, more usefully, explains what each one actually prevents, because a list of header names is why most of them never get set.

Reads the response headers your site already returns to every visitor. Nothing else.

A word on Content-Security-Policy

It is the highest-value header here and the only one that takes real work, which is why it is the one most often missing. A policy that allows unsafe-inline gives away most of the protection, so it scores as weak rather than set.

The workable route is report-only first. Deploy the policy in reporting mode, collect violations for a fortnight, fix the legitimate ones, then enforce. Attempting to write a correct policy in one pass and enforcing it immediately is how sites end up rolling it back and never trying again.