BLACKOPS SOFTWARE
BLACKOPS / TOOL

HTTP security header review

Turn a response snapshot into a contextual browser-policy review, with evidence and the next checks to make.

Purpose, output & limits Evidence-backed response review
USE WHEN

Before changing browser policies on an application.

TAKE AWAY

Evidence-backed response review

DOES NOT

Does not scan a site or validate an entire CSP.

Processed in this page’s memory. No tool-input uploads, target requests or persistent input storage. Clear or reload to discard this draft. Downloads are saved only when you request them. Keep secrets and confidential records out.

01 / EVIDENCE & CONTEXT

Start with one response.

Copy response headers from browser developer tools. Unsupported header values are removed; supported policy values remain. Remove credentials and sensitive URLs first.

A non-sensitive identifier for the handoff, not a URL to scan.
Maximum 24,000 characters. Header lines only; no response body.
How to obtain the right evidence

In browser developer tools, open Network, select a document or API response and copy the response-header lines. Record which response and environment you selected. A request header or a URL is not the same evidence.

A deliberate review.
A usable document.

Paste a response snapshot, set its context and run the review. No target will be contacted.

  1. Recognized evidence, not a score
  2. Interpretation with explicit limits
  3. Next checks and an exportable report

Understand the result.

All technical guides
Application security 11 min read

Deploying CSP: move from reports to controlled enforcement

Content Security Policy needs an application inventory, a compatible script strategy and a measured rollout. A pasted header is only the beginning.

Read article