Check before launch
Security Headers and CORS Checker
This local HTTP header checker reviews pasted response headers for common browser-security omissions, permissive CORS signals, framing protection, and missing cookie attributes.
Local analyzer: Runs entirely in this browser. Headers stay in your browser.
What this checks
- Presence of CSP, HSTS, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy
- X-Frame-Options or a CSP frame-ancestors directive
- Wildcard CORS signals and Secure, HttpOnly, and SameSite cookie attributes
What this cannot prove
- It does not fetch your URL or observe redirects, preflight requests, or route-specific behavior
- It checks a focused set of names and patterns, not whether every policy value is safe
- A clear result does not establish exploitability or overall application security
Primary references
Use these standards and vendor references when you investigate a result. A link does not imply certification or full coverage of the source.
Need an app-wide assurance record?
LyraShield AI adds authorized target scanning, explicit coverage receipts, evidence states, approval-gated fix proposals, server-owned retests, and immutable reports. This browser tool remains guidance, not a security guarantee.
Get product updatesFrequently asked questions
Does this upload my input?
Headers stay in your browser.
Does a clear result mean my app is secure?
No. Each result is limited to the checks shown here. Use it as a next-step guide, then test the relevant application path.