Web Security
Security headers, CSP, CORS and exposure checks.
The tools in the Web Security category inspect the security settings your site sends to browsers, helping you block common attacks like XSS, clickjacking, session hijacking, and data leakage. In one place you can check and decode security headers (HSTS, X-Frame-Options, X-Content-Type-Options), Content Security Policy (CSP), CORS configuration, cookie security flags (Secure, HttpOnly, SameSite), Permissions Policy and Referrer Policy, security.txt, and Subresource Integrity (SRI). They are built for web developers, frontend engineers, site operators, and anyone preparing for a security audit who needs to spot missing headers or misconfigured policies quickly, before and after a deploy.
A typical workflow starts by reviewing the full set of response headers to see which security headers are missing, then decoding complex policies like CSP and CORS directive by directive to tighten anything overly permissive (for example unsafe-inline or a wildcard *). From there you review your cookies' SameSite, Secure, and HttpOnly combination, confirm that external scripts carry SRI hashes, and make sure security.txt exposes a contact channel for vulnerability reports. Because every check simply interprets the headers and policy strings a browser actually sees, the best approach is iterative: change a setting, re-run the check, and confirm the result improved.