HTTPS, Headers & HTTP Reference Checker

It reviews the URL scheme of each crawl record, quoted src and href values beginning with http:// on captured HTTPS pages, explicit HTTP form actions and script sources, and the presence of HSTS, CSP, X-Frame-Options or CSP frame-ancestors, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy in retained HTTPS response headers.

No. It does not audit certificate chains, expiry, protocol versions, cipher suites, HTTP-to-HTTPS variants, HSTS preload status, network requests after rendering, CSS URLs, service workers, API traffic, or every route and response type. Test those separately with browser and transport-aware tools.

No. Header choice and value depend on the route, threats, required embeds, content sources, browser support, subdomains, and deployment architecture. A presence check also cannot detect weak, conflicting, duplicated, obsolete, or incorrectly scoped values.

Inventory required behavior first. Build CSP from the application's actual sources, start complex policies in report-only mode, review violations, and test sign-in, checkout, media, analytics, and embeds before enforcement. Decide which origins may frame each route before setting frame-ancestors or X-Frame-Options.

No. Confirm HTTPS works first and choose max-age deliberately. includeSubDomains affects every covered subdomain, while preload has additional requirements and operational consequences. Test the complete domain estate and understand rollback before expanding either scope.

Shareable or browser-stored crawl data can omit raw HTML. Response headers may also be absent from older or browser-based crawls. In those cases the analyzer cannot repeat HTML reference checks or draw a complete header conclusion; run a fresh lightweight crawl and verify findings in a browser.