Defensive Audit Tool
HTTP Security Header Analyzer
Evaluates web endpoints against OWASP defense-in-depth criteria. Inspects HSTS, Content-Security-Policy, Clickjacking headers, and technology disclosure with actionable server hardening snippets.
Authorized Scope Boundaries: In accordance with responsible testing principles, internal subnets (RFC1918), loopback adapters, and cloud metadata endpoints (169.254.169.254) are rejected at the DNS resolution layer.
Quick authorized test targets: