HTTP response headers can guide browser behavior and add useful security controls. Their effect depends on the policy value, page behavior and server configuration—not merely on whether a header is present.
CSP limits which sources a browser may use for scripts, styles, images and other resources. Build directives around the application's real dependencies. A policy that is too broad adds little protection; one that is too strict can break legitimate pages. The Content-Security-Policy-Report-Only header lets you observe policy violations without enforcing the candidate policy; review behavior before you enforce it.
HSTS tells browsers that a host should be accessed using HTTPS for a stated period. Confirm HTTPS is correctly deployed first. Add subdomain coverage only when every affected subdomain is HTTPS-ready; long durations can keep a mistaken policy active in browsers.
nosniff asks browsers to respect the declared media type instead of guessing. It works best when the server sends accurate Content-Type values for scripts, styles and downloads. Check file handling as well as the header.
CSP's frame-ancestors directive controls which sites may embed a page and is the modern policy to review. Check whether the application intentionally supports trusted embedding. A blanket deny policy may break that workflow.
This controls how much referrer information browsers send when navigating from your pages. Choose a policy that fits analytics and application requirements while avoiding unnecessary path or query detail disclosure.
This can limit browser capabilities such as camera, microphone and geolocation for a page or embedded frames. Set it according to features the site actually uses; it does not replace application permissions or user consent.
The free local header helper checks selected header presence and a few simple policy-value warning signs in text you paste. It is not a complete standards parser, does not fetch your website, test browser behavior, inspect every response path, score security or establish that the site is secure. Check representative pages and redirects, review browser developer tools, and test changes in staging. See the MDN Content Security Policy guide, MDN HSTS reference and OWASP HTTP Headers Cheat Sheet for implementation details.
For a public hostname you are authorized to scan, prepare an opt-in SSL Labs link. Cloudek does not fetch the hostname or run the scan; the external service receives it only when you open the link.
Copy only the response-header lines from a trusted browser or diagnostic tool. Remove cookies, tokens, internal hostnames and other sensitive values before pasting.
