headersec.com

Live preview

This site's Content-Security-Policy restricts embedding to specific origins ("frame-ancestors 'none'"), which does not include StatsMyWeb.

Since headersec.com can't be embedded live, this is a captured screenshot instead — a snapshot from whenever it was last rendered, not necessarily this exact moment.

HTTP & security headers

Response

Server

cloudflare

Content-Type

text/html; charset=utf-8

Cache-Control

public, max-age=0, must-revalidate

Content-Encoding

Not sent

Security

Content-Security-Policy

default-src 'self'; script-src 'self' 'sha256-1V96AigzsbBEIHDLD/EoFqEKo4xXZ8LBym8jkiRZCzo=' 'sha256-5SGdCqkhWggWoA9Hegf4tENgeHaO+xH+mwKNJcSMffY=' 'sha256-A9BrgB72/f1C5uEKTmQrkZd7ekPLC18pYKZEAfMCKjc=' 'sha256-EJjsVSMORsjlYnIGD6ptsGcWX+Cclxfq3zrLUqbNFz8=' 'sha256-GVLmkzaJ+yl8ki/LL7rTImZgVZqttzS5AKrfir9Ysfc=' 'sha256-GcW6IhBCWAJ+uGayhQzgU+OTmp00OFDoejMzOoUgcd8=' 'sha256-VHcvHVmV/8QJPFj5XK7F79ePH1Snt2rG2h4l/e9gStk=' 'sha256-WlUaJeUTdTfv04/ov4xgzMYATDRhU1LEAm4CbY7yHIk=' 'sha256-hql+QCc9FLPoG61/zYp0w87I48/sk5VFJQDhSrLr/PU=' https://challenges.cloudflare.com https://static.cloudflareinsights.com; connect-src 'self' https://api.headersec.com https://headersec-api.viweb.workers.dev https://challenges.cloudflare.com https://cloudflareinsights.com https://*.cloudflareinsights.com; frame-src https://challenges.cloudflare.com; style-src 'self' 'sha256-3eAQeCzqRZh4hsSC8kz6Gt1nUL7bjUkZtYuvGKmjdJU='; style-src-attr 'unsafe-hashes' 'sha256-S8qMpvofolR8Mpjy4kQvEm7m1q8clzU4dfDH0AmvZjo='; img-src 'self' data: https://cloudflareinsights.com https://*.cloudflareinsights.com; font-src 'self' data:; object-src 'none'; base-uri 'self'; frame-ancestors 'none'; form-action 'self'; upgrade-insecure-requests

Strict-Transport-Security

max-age=31536000; includeSubDomains

X-Frame-Options

Not sent

X-Content-Type-Options

nosniff

Referrer-Policy

strict-origin-when-cross-origin

Permissions-Policy

accelerometer=(), autoplay=(), camera=(), display-capture=(), encrypted-media=(), fullscreen=(self), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), midi=(), payment=(), publickey-credentials-get=(), usb=()

What each security header does

Redirect chain

1. 1.http://headersec.com/HTTP 301

   → https://headersec.com/

2. 2.https://headersec.com/HTTP 200

Meta tags

Title

HTTP Security Header Scanner | HeaderSec

Description

Scan any public URL for HTTP security headers, get a clear score, and see actionable fixes for HSTS, CSP, clickjacking, MIME sniffing, and more.

Canonical

https://headersec.com/

Robots

Not set

Generator

Not set

Open Graph title

HTTP Security Header Scanner | HeaderSec

Open Graph description

Scan any public URL for HTTP security headers, get a clear score, and see actionable fixes.

Open Graph image

https://headersec.com/brand/logo-web.png

Open Graph type

website

Twitter card

summary_large_image

Twitter title

HTTP Security Header Scanner | HeaderSec

Twitter image

https://headersec.com/brand/logo-web.png

robots.txt

Disallow rules (User-agent: *)

0

Disallow rules (other agents)

0

Technology detected

Best-effort, based on a small set of well-known signals — this may be incomplete.

• Cloudflarecdn

  Server: cloudflare

Related domains