./prontouso.com

BẢO MẬT & RIÊNG TƯ

Quét Header Bảo Mật Web

Quét và đánh giá mức độ bảo mật của trang web thông qua các tiêu đề HTTP phản hồi: HSTS, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy và Permissions-Policy.

Trạng thái công cụSử dụng xử lý máy chủ
Xem trước

Enter a URL to check its HTTP security headers.

Cách thức hoạt động

  1. Nhập dữ liệu của bạn

    Điền các giá trị cần thiết, dán văn bản hoặc tải lên tệp bạn muốn xử lý.

  2. Xem kết quả tức thì

    Hầu hết các công cụ cập nhật theo thời gian thực khi bạn nhập liệu; một số công cụ sử dụng một nút hành động duy nhất.

  3. Sử dụng kết quả

    Sao chép, tải xuống hoặc chia sẻ kết quả được tạo — bạn luôn có toàn quyền kiểm soát dữ liệu của mình.

What this tool fetches, and what it does not — The URL you enter is sent to a ProntoUso server so it can request the site's public response headers for this scan. The page body is never downloaded, redirects are reported but not followed automatically, and private or internal addresses are refused. The URL and returned headers are not stored.

Quét Header Bảo Mật Web là gì?

Enter a URL to fetch its HTTP response headers and see which browser-side protections it turns on, and which ones it's missing.

TÌM HIỂU CÁCH HOẠT ĐỘNG CỦA CÔNG CỤ

How to scan a site's HTTP security headers

Why this needs a server

Browsers deliberately block a page from reading most of another origin's response headers through JavaScript — that's a core part of the same-origin policy. Checking a site you don't control from the browser alone isn't possible, so this tool's backend makes the request instead and reports back only the headers, never the page's content.

What gets checked

Eight headers that consistently matter for transport security and browser-side hardening: Strict-Transport-Security, Content-Security-Policy, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy, Cross-Origin-Opener-Policy, and Cross-Origin-Resource-Policy. Each has a short explanation next to its result.

This is a starting checklist, not a full audit. A header being present does not confirm its value is well configured for your specific site — a Content-Security-Policy of "default-src *", for instance, counts as present here even though it provides little real protection.

Reading the grade

The score weighs headers by how much they typically matter: Strict-Transport-Security, Content-Security-Policy, and X-Content-Type-Options count for the most, X-Frame-Options, Referrer-Policy, and Permissions-Policy count for less, and the two Cross-Origin-* headers count for least. The grade is a rough summary, not a certification.

What this tool fetches, and what it does not

The URL you enter is sent to a ProntoUso server so it can request the site's public response headers for this scan. The page body is never downloaded, redirects are reported but not followed automatically, and private or internal addresses are refused. The URL and returned headers are not stored.

Các Câu Hỏi Thường Gặp (FAQ)

Can I scan any URL, including internal or local addresses?

No. Requests to private, loopback, link-local, and other internal address ranges are blocked before any connection is made, so this cannot be used to probe your own internal network.

Does it follow redirects?

No. If the URL responds with a redirect, that redirect response's own headers are shown, and the destination is never automatically fetched.

Does a good grade mean the site is fully secure?

No. It means the checked headers are present. Header configuration is one layer of web security among many, and a present header can still be configured too loosely to be effective.

Why does it only work on the default HTTP/HTTPS port?

It keeps the tool focused on scanning real websites rather than becoming a general-purpose port prober.

Công Cụ Liên Quan