HTTP Security Headers and Cookies

These tools work on a site’s HTTP response. Check all security headers at once, then go deeper on HSTS, X-Frame-Options and Content Security Policy, where the evaluator reads a policy and the generator builds one. The cookie tools list Secure, HttpOnly and SameSite flags and build a Set-Cookie line.

Tools in this group

• Cookie Checker — Enter a web address, or paste Set-Cookie lines, to check every cookie's security attributes.
• Cross Origin Opener Policy (COOP) Checker — Check a page's Cross-Origin-Opener-Policy, see whether it is cross-origin isolated and generate the header lines.
• CSP Evaluator — Paste a Content Security Policy, or enter a web address, to see its directives and weaknesses.
• Content Security Policy Generator — Choose a starting policy and add the sources you need to get a CSP header and meta tag.
• HSTS Checker — Enter a host name, or paste the header, to check its HSTS policy and preload readiness.
• SameSite Cookie Builder (Cookie SameSite) — Set a cookie's attributes to get the Set-Cookie line and a table of when the browser sends it.
• Security Headers Checker (HTTP Headers Checker) — Enter a web address, or paste response headers, to check each security header with a reason and a fix.
• X Frame Options Checker — Enter a web address, or paste headers, to see whether other sites can show the page in a frame.