IPTOOL TR My IP

Security

HTTP security header test

Score HTTP security headers (HSTS, CSP, XFO…).

Queries leave from this Linux server, not your ISP DNS. Free. Cached answers can differ for a short time.

HSTS, CSP, X-Frame-Options, nosniff, Referrer-Policy and Permissions-Policy harden the browser. Gaps affect the letter grade.

If HEAD is unsupported, GET is tried. Redirects never follow into private networks (SSRF protection). The grade is guidance, not a pentest.

HSTS max-age and includeSubDomains matter for HSTS preload. CSP unsafe-inline widens XSS. Cross-Origin-Opener-Policy improves isolation.

Frequently asked questions

Why is the grade low without CSP?

CSP is the strongest XSS-related header. Its absence drops the score a lot.

Why is the grade low without HTTPS?

Most of these headers only make sense on HTTPS. Certificate first, then headers.

Is X-Powered-By bad?

It leaks the stack. Removing it reduces disclosure; it affects the grade a little.

Are redirects followed?

Only same-host public URLs. Private-network IPs are not followed.

How do I get an A+?

HSTS, a tight CSP, nosniff, Referrer-Policy and frame controls together. Not every site needs A+.