Free tool

Check a site's security headers

Enter a website and we'll fetch its HTTP response headers, grade the security ones, and explain in plain language what each does and what's missing.

How this works
  • We make a single request to the address from our server and read only the response headers.
  • We don't store the result, and nothing is shared unless you copy the link.

You're viewing a shared result.

Security headers

cactus.net

6 of 6 recommended headers present · HTTP 200

A+

Header grade

Why this grade
  • All recommended security headers are present - excellent posture.

Headers

Recommended security headers

  • Strict-Transport-Security Present

    Strict-Transport-Security forces browsers to use HTTPS, preventing downgrade and cookie-theft attacks.

    max-age=31536000; includeSubDomains; preload
  • Content-Security-Policy Present

    Content-Security-Policy limits what a page can load - the strongest defence against cross-site scripting (XSS).

    default-src 'self'; script-src 'self' 'nonce-l+8he6eTQK+BG37mKdMUuA==' static.cloudflareinsights.com; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self'; connect-src 'self' cloudflareinsights.com; worker-src 'self'; frame-ancestors 'none'; form-action 'self'; object-src 'none'; …
  • X-Content-Type-Options Present

    X-Content-Type-Options: nosniff stops the browser from guessing file types, blocking a class of attacks.

    nosniff
  • X-Frame-Options Present

    X-Frame-Options (or CSP frame-ancestors) stops other sites from embedding this one to trick you (clickjacking).

    DENY
  • Referrer-Policy Present

    Referrer-Policy controls how much address information leaks when you follow a link to another site.

    strict-origin-when-cross-origin
  • Permissions-Policy Present

    Permissions-Policy limits which browser features (camera, microphone, location) a page may use.

    camera=(self), microphone=(), geolocation=(), payment=(), usb=(), serial=(), bluetooth=(), hid=(), midi=(), accelerometer=(), gyroscope=(), magnetometer=(), interest-cohort=()

Response

Other details

Final URL
https://cactus.net/
Server
cloudflare
Important limitation

These headers are one signal of a site's security hygiene, not a verdict on whether the site is safe or trustworthy. A site can have perfect headers and still be malicious, or miss headers and be perfectly legitimate.

Certificate won't renew? Debug ACME issuance for cactus.net