CheckVibeCodeCheckVibeCode
Checks/Configuration
ConfigurationLive9 checks

Security Headers Scanner

Check if your site has the right HTTP security headers to prevent common attacks.

Run this scanSee pricing

What we check

  • Strict-Transport-Security — present, max-age ≥ 6 months, includeSubDomains
  • Content-Security-Policy — present, no unsafe-inline/unsafe-eval on script-src
  • X-Content-Type-Options: nosniff
  • X-Frame-Options or a CSP frame-ancestors directive
  • Referrer-Policy
  • Permissions-Policy
  • Cross-Origin-Opener-Policy / Cross-Origin-Resource-Policy / Cross-Origin-Embedder-Policy
  • Server / X-Powered-By banner disclosure
  • Overall grade (A–F) modeled on Mozilla Observatory's rubric

More checks in Configuration

SSL/TLS Security ScannerCookie & Session Security ScannerMobile Interface ScannerContainer & IaC Misconfiguration ScannerSupabase Security ScannerFirebase Security Scanner