A website can tell the browser how to protect its visitors. It does that with a handful of response headers, and most small sites send none of them. Not because the owner decided against them, but because nothing ever asked.
IndieHeaders asks. Enter a URL or a domain. The tool requests the page once from Cloudflare’s
network, reads the response headers, and grades six of them: Strict-Transport-Security,
Content-Security-Policy, framing through X-Frame-Options or frame-ancestors,
X-Content-Type-Options, Referrer-Policy, and Permissions-Policy. Each row says whether the header is
in place, weak, or missing, what it does in one sentence, the value found, and the exact line to
add. A button copies every missing line at once.
Two things make the answer more honest than a letter grade. The tool also probes plain HTTP once,
because a site that never redirects http:// to https:// gets no help from HSTS, and that is a
failure before any header is counted. And it reads the page’s <meta> tags for a
Content-Security-Policy and a referrer policy, because a policy in a meta tag protects the page too.
It says where it found each one, and it says what a meta tag cannot do: set frame-ancestors,
report violations, or cover a response that is not HTML.
The rules come from MDN Web Docs and the OWASP HTTP Headers Cheat Sheet, and every row links the page it rests on with the day it was read. A full set of headers does not make a site secure, and the result says so. The tool does not run the page, test whether a policy is correct, or scan for vulnerabilities. It reports what one plain request received.
The first thing IndieHeaders checked was its own family. Every sister site answered with none of
the six. The fix was one _headers file in the shared template, and every site got it the same
evening. That is the kind of gap this tool exists to find.
The core stays free. There is no account, no card, no premium plan, and no public list of checked sites. IndieHeaders stores no lookup history and loads no analytics or third-party script.