Security Headers Checker — How to Use and Read HPKP/CSP/HSTS
Use the OpenTrojan Security Headers checker to passively probe a site's CSP, HSTS, X-Frame-Options response headers and see hardening gaps.
Quick Answer
Security Headers sends a single passive probe and reports CSP, HSTS, X-Frame-Options and related response headers, showing which hardening controls are present or missing.
Definition
Security Headers performs a passive HTTP probe and reports the security-related response headers a site returns.
What it is
Security Headers (/tools/headers/) makes a single, passive, restricted request to a host and reads the security-related response headers.
How to use
- Enter the target host.
- The tool performs one probe and lists which headers are present: CSP, HSTS, X-Frame-Options, nosniff, Referrer-Policy, Permissions-Policy, and more.
- Compare the present vs recommended set.
Interpretation
- Missing HSTS — users can be downgraded over plain HTTP; flag for prioritization on sensitive hosts.
- Weak/absent CSP — weaker XSS mitigation; review
script-src/default-srcand frame-ancestors. - Missing X-Frame-Options/CSP frame-ancestors — clickjacking exposure.
- Each missing header is a control gap, not proof of exploitation.
Limitations
- It is a single passive probe; results reflect the version/host you queried and can vary by edge, path and environment.
- Header presence is not a substitute for validating that the policy is actually effective.
Privacy
A single restricted probe is sent; the host is recorded as lookup activity. No content is downloaded or stored.
Next steps
- Harden with the right policy → see Application security hub.
- Protect other layers → Network security hub.
References
Ask OpenTrojan's evidence-backed assistant about this topic — answers cite their sources.