Truvo Free Tools

HTTP security headers checker

HTTP security headers are instructions your site sends to the browser about what scripts may run, who may frame your pages and what data may leak. This checker reads them from one normal request and names the SOC 2 and ISO 27001 controls each missing header affects.

SOC 2 CC6.1SOC 2 CC6.8SOC 2 CC7.1ISO 27001 A.8.9ISO 27001 A.8.27
Ali Aleali

Ali Aleali, CISSP, CCSP

Co-Founder & Principal Consultant

Former security architect for Bank of Canada and Payments Canada. 20+ years building compliance programs for critical infrastructure. These tools come out of that work.

Connect on LinkedIn

How the HTTP security headers checker works

The check is passive: it makes one normal HTTPS request to your homepage and reads the response headers, the same way a browser does.

01

Query

You enter a domain. The tool requests the homepage over HTTPS once and captures the response headers. No other page is fetched and nothing is submitted.

02

Read

The result checks for Content-Security-Policy, X-Frame-Options or a frame-ancestors directive, X-Content-Type-Options, Referrer-Policy and Permissions-Policy, and whether the Server header advertises an exact software version.

03

Map

Each finding names the controls it speaks to: SOC 2 CC6.1, CC6.8 and CC7.1, and ISO 27001:2022 A.8.9 (configuration management) and A.8.27 (secure system architecture and engineering principles). A complete set is evidence of a hardened configuration; a missing header is a gap to close.

Found a gap? We fix it for you.

Truvo's security engineers harden web configuration, TLS and DNS, and hand you the evidence an auditor asks for. Tell us the domain and we will scope the fix.

Contact us

  • Content-Security-Policy

  • Clickjacking protection

  • HSTS and TLS

  • Server hardening

  • Audit evidence

  • Fixed-price scope

Security headers: frequently asked questions

It reads the HTTP response headers your site sends and checks for the ones browsers use to protect visitors: Content-Security-Policy (which scripts and frames may load), X-Frame-Options or frame-ancestors (who may embed your pages), X-Content-Type-Options (blocks MIME sniffing), Referrer-Policy (what URL data leaks to other sites) and Permissions-Policy (which browser features scripts may use). It also notes a Server header that leaks an exact version.

Truvo maps header findings to SOC 2 CC6.1, CC6.8 and CC7.1, and to ISO 27001:2022 Annex A controls A.8.9 (configuration management) and A.8.27 (secure system architecture and engineering principles). The mapping is advisory: it shows which control a finding gives evidence for or signals a gap against. It is not a substitute for an audit.

Yes. The tool makes a single HTTPS request to your homepage, the same request a browser makes, and reads the headers in the response. Nothing is written or changed.

Content-Security-Policy. It is the strongest browser-side defence against cross-site scripting: even if a script is injected into a page, a tight policy stops the browser from running it. The usual approach is to start in report-only mode, list the sources your site needs, then enforce with restrictive script-src, object-src 'none' and frame-ancestors directives.

No. They limit the damage when something else goes wrong, which is why auditors read them as configuration controls rather than as the whole answer. Each is a one-line change at your web server or CDN, so they are usually the first fix, not the last.