hdrcheck: security headers in one request

Before a launch, someone asks "do we have HSTS?" and someone else pastes a half-remembered checklist. hdrcheck fetches a public URL once, scores the usual security headers, and returns fix tips.

Live: https://hdrcheck.sybilgambleyyu.workers.dev

curl -s 'https://hdrcheck.sybilgambleyyu.workers.dev/?url=https://example.com&format=json' | jq .score

Or open the HTML form in a browser. No account, no tracking.

What it scores

• Strict-Transport-Security
• Content-Security-Policy
• X-Content-Type-Options
• X-Frame-Options / CSP frame-ancestors
• Referrer-Policy
• Permissions-Policy
• Cross-Origin-Opener-Policy
• Cross-Origin-Resource-Policy

Source: github.com/SybilGambleyyu/hdrcheck · runs on Cloudflare Workers.

Canonical post: https://sybilgambleyyu.github.io/posts/hdrcheck/