Hackal Run
Security Headers Check
Check the HTTP security headers and cookie flags a browser sees when it visits your site. It's a quick, passive read of what is publicly returned.
What this checks, and why it matters
When a browser loads your site, your server sends back a set of HTTP response headers. A few of them are security controls: they tell the browser to enforce HTTPS, keep your pages from being framed, restrict where scripts can load from, and stop content-type guessing. Cookies carry their own flags that decide whether they can travel over plain HTTP or be read by JavaScript.
These headers are easy to miss because a site works fine without this protection. This check reads the headers and cookie flags your site returns for a single request and tells you which are present and which are worth adding.
This surface-level tool only reads one response and does not crawl your whole site, test authenticated pages, or watch for changes over time.
Questions
What are security headers?
Security headers are HTTP response headers that tell the browser to enforce security protections, such as Strict-Transport-Security to force HTTPS, Content-Security-Policy to control where resources load from, X-Frame-Options to prevent framing, and X-Content-Type-Options to stop MIME sniffing.
Which headers and cookie flags does this check look at?
This check looks for the common security headers, including HSTS, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy, along with the Secure, HttpOnly, and SameSite flags on the cookies your site sets.
Is this a full security audit?
No, just a quick look at a single site response, meant as a sanity check when you launch a new site or web app. This doesn't test authenticated areas or business logic. Hackal's platform monitors your site's attack surface continuously and turns findings into prioritized fixes.
More Hackal Run checks
Beyond the spot-check
The quick look is just the start.
Unlike the tools on this page, the Hackal platform monitors your site's external attack surface continuously, and turns findings into prioritized, plain-English fixes.
See the platform