Security headers check

HTTP security headers check

HTTP response headers are instructions to the browser: whether to insist on HTTPS, what content sources to trust, whether the page can be framed by another site. Wraith checks the ones that matter most.

$9.00 one-time · no subscription

Strict-Transport-Security (HSTS)

Tells browsers to only ever connect to your site over HTTPS, even if a link or a typo points at plain HTTP — closing the window where a downgrade attack is possible.

Content-Security-Policy

Restricts which sources a page is allowed to load scripts, styles and other content from, reducing the impact of a cross-site scripting vulnerability if one is ever introduced.

Framing, content-type, and referrer controls

Wraith also checks the headers that control whether your pages can be embedded in a frame on another site, whether browsers are told not to guess a resource’s content type, and how much referrer information is sent to the sites your pages link to.

The HTTPS redirect

A plain HTTP request to your domain should redirect to HTTPS. Wraith checks that it does, on every authorized hostname.