检测内容
查看 CSP、防止类型嗅探等响应安全策略。
用途说明
将检测到的公开配置与网站预期设置核对，可帮助定位访问、证书和抓取问题。结果反映检测当时的响应，网络环境或网站防护可能影响部分项目。
HTTP 安全头
查看 CSP、防止类型嗅探等响应安全策略。
技术术语
- Cross-Site Scripting (XSS)
- Getting a script to run on someone else's site, where it can steal visitors' sessions or act as them.
- Clickjacking
- Loading a site in a hidden frame on another page, so visitors click its buttons without realising.
- Content-Security-Policy
- Lists where a page may load scripts and other files from, which blocks most cross-site scripting.
- X-Content-Type-Options
- Stops browsers guessing a file's type, so an uploaded file can't be run as a script.
- X-Frame-Options
- Stops other sites showing this page in a frame, which blocks clickjacking.
- Referrer-Policy
- Controls how much of the current URL is shared with other sites when visitors follow links or load files.
- Permissions-Policy
- Turns off browser features like the camera, microphone and location for the page and anything it embeds.
- Cross-Origin-Opener-Policy
- Keeps the page in its own window group, so pop-ups and other sites can't reach into it.
- Cross-Origin-Resource-Policy
- Stops other sites loading this site's files, which guards against Spectre-style data leaks.
- Cross-Origin-Embedder-Policy
- Only lets the page load files from other sites that allow it, which unlocks features that need Spectre protection.
- X-XSS-Protection
- An old browser filter for cross-site scripting, since removed from browsers. It should now be set to 0.