Security Header Analyzer

{
  "statusLine": "HTTP/2 200 OK",
  "parsedHeaderCount": 9,
  "ignoredLines": {
    "count": 0,
    "lineNumbers": []
  },
  "summary": {
    "pass": 14,
    "warning": 0,
    "info": 0
  },
  "checks": [
    {
      "id": "hsts",
      "title": "HTTP Strict Transport Security",
      "status": "pass",
      "summary": "HSTS has a max-age of at least one year and includes subdomains."
    },
    {
      "id": "csp",
      "title": "Content Security Policy",
      "status": "pass",
      "summary": "1 enforcing CSP policy was found.",
      "recommendation": "Review the effective policy in a browser because multiple CSP headers are enforced together."
    },
    {
      "id": "csp-unsafe-directives",
      "title": "CSP unsafe directives",
      "status": "pass",
      "summary": "No unsafe-inline or unsafe-eval tokens were found in the effective CSP directives."
    },
    {
      "id": "csp-object-src",
      "title": "CSP object sources",
      "status": "pass",
      "summary": "object-src is explicitly set to 'none'.",
      "evidence": [
        "Policy 1: object-src 'none'"
      ]
    },
    {
      "id": "csp-frame-ancestors",
      "title": "CSP frame ancestors",
      "status": "pass",
      "summary": "frame-ancestors places an explicit restriction on embedding.",
      "evidence": [
        "Policy 1: frame-ancestors 'none'"
      ]
    },
    {
      "id": "content-type-options",
      "title": "MIME sniffing protection",
      "status": "pass",
      "summary": "X-Content-Type-Options is set to nosniff."
    },
    {
      "id": "referrer-policy",
      "title": "Referrer policy",
      "status": "pass",
      "summary": "The selected policy is strict-origin-when-cross-origin.",
      "evidence": [
        "strict-origin-when-cross-origin"
      ]
    },
    {
      "id": "permissions-policy",
      "title": "Permissions policy",
      "status": "pass",
      "summary": "3 explicit feature policies were found.",
      "recommendation": "Confirm every enabled capability and origin is required by the application.",
      "evidence": [
        "camera=()",
        "microphone=()",
        "geolocation=()"
      ]
    },
    {
      "id": "clickjacking",
      "title": "Clickjacking protection",
      "status": "pass",
      "summary": "An enforcing CSP frame-ancestors restriction was found.",
      "evidence": [
        "Policy 1: frame-ancestors 'none'"
      ]
    },
    {
      "id": "coop",
      "title": "Cross-Origin-Opener-Policy",
      "status": "pass",
      "summary": "COOP is set to same-origin.",
      "evidence": [
        "same-origin"
      ]
    },
    {
      "id": "corp",
      "title": "Cross-Origin-Resource-Policy",
      "status": "pass",
      "summary": "CORP is set to same-site.",
      "evidence": [
        "same-site"
      ]
    },
    {
      "id": "cookie-secure",
      "title": "Cookie Secure attribute",
      "status": "pass",
      "summary": "Every pasted Set-Cookie value includes Secure.",
      "evidence": [
        "session"
      ]
    },
    {
      "id": "cookie-httponly",
      "title": "Cookie HttpOnly attribute",
      "status": "pass",
      "summary": "Every pasted Set-Cookie value includes HttpOnly.",
      "evidence": [
        "session"
      ]
    },
    {
      "id": "cookie-samesite",
      "title": "Cookie SameSite attribute",
      "status": "pass",
      "summary": "Every pasted Set-Cookie value has a recognized SameSite setting.",
      "evidence": [
        "session: lax"
      ]
    }
  ]
}