Security Headers Workbench
Security Headers Workbench reviews pasted HTTP response headers locally and highlights common defensive controls. It is intended for fast review during site hardening, advisory preparation, and deployment checks where a full scanner would be unnecessary or inappropriate.
The tool focuses on high-signal headers: Content Security Policy, HTTP Strict Transport Security, X-Content-Type-Options, referrer policy, frame restrictions, and permissions policy. It does not crawl a site, fetch remote URLs, judge the business correctness of a policy, or replace manual review of generated output.
Parsed headers: 0
Data Handling
- Headers are pasted by the user and processed in browser memory.
- The tool does not request the target URL or contact the remote host.
- No pasted headers are uploaded, logged, persisted, or sent to a backend service.
- Output is advisory and should be reviewed before being copied into production configuration.
Boundary
A header checklist cannot prove that an application is secure. CSP can be syntactically present while still too permissive; HSTS can be dangerous if subdomains are not HTTPS-ready; and permissions policy can break features if copied blindly. Treat this workbench as a triage and consistency aid, then validate headers against the deployed environment.
Tool Standard
Tool pages should describe the input boundary, execution model, output interpretation, and unsupported cases. A security tool is more credible when it clearly states what it does not inspect, upload, verify, or retain.