Web Security Configuration Workbench
Review a site's security headers, CSP, HSTS and cookies
- Content-Security-Policy review
- HSTS and preload readiness
- Cookie flags
About Web Security Configuration Workbench
Enter a URL to see the HTTP security headers it returns and what they mean in practice: whether the Content-Security-Policy allows inline or broadly sourced scripts, whether HSTS meets the preload rules, how session cookies are flagged, and whether another site could frame the page. Missing headers come with copy-ready snippets for Next.js, Vercel, Nginx, Apache, Cloudflare and Express. Requires a free account.
Headers that browsers act on
Several protections only work if the server asks for them. Content-Security-Policy limits where scripts and other resources can load from. Strict-Transport-Security tells browsers to use HTTPS only. Cookie attributes decide whether a session cookie can be read by scripts or sent with requests from other sites. Frame and cross-origin policies control whether other sites can embed or interact with the page.
The workbench fetches the URL from MemonaIQ’s servers, following up to 10 redirects, reads these headers and cookies, and explains each finding in terms of what an attacker could or couldn’t do. It needs a free account, and each check uses one unit of your daily allowance.
Fixing what it finds
Missing headers come with configuration snippets for Next.js, Vercel, Nginx, Apache, Cloudflare and Express, plus a generic header list. Weak CSP directives and cookie flags are explained but don’t get a generated snippet. Roll out a new Content-Security-Policy in report-only mode first: a policy that is too strict can break analytics, payments or embedded widgets.
What it doesn’t cover
This is a review of browser-facing configuration. It doesn’t test for vulnerabilities in your application code, scan for outdated software or probe your servers. Use it as one input to a security review, not a certificate of security.
Further reading
Questions people ask
- What is a good Content-Security-Policy?
- One that lists only the sources your pages actually need, avoids 'unsafe-inline' and 'unsafe-eval' for scripts, and sets object-src 'none' and a base-uri. Nonces or hashes let you keep inline scripts you can’t remove.
- What does HSTS preload mean?
- Browsers ship with a list of domains that must always use HTTPS. To be accepted, a site’s HSTS header needs a max-age of at least one year, includeSubDomains and the preload directive. When your header includes preload, the workbench checks the other two.
- Can I check a site I don’t own?
- The check reads the same headers any visitor receives. Use it on sites you’re responsible for or have permission to review.