Headers & Cookies

This group helps you inspect and harden a website's HTTP setup. It includes Security headers, CSP Constructor and Cookie inspector. Developers, administrators and auditors can use it before a release, when debugging a CORS issue or when checking cookie attributes. No account is needed for these five utilities, and the processing stays local.

Start with Security header audit when you want a broad view of missing protections. To build a policy, use CSP Constructor, then Security headers to assemble a consistent baseline. CORS tester answers a narrower question about one origin, and Cookie inspector details Secure, HttpOnly and SameSite. Pick the tool based on whether you measure, generate, test or inspect.

How to use

  1. To measure the current setup, run Security header audit first and note which protections are missing before changing anything.
  2. To prepare a policy, open CSP Constructor, then use Security headers to assemble a consistent baseline around allowed content.
  3. For a specific call, use CORS tester with the origin and address involved, then check whether access is allowed.
  4. Finish with Cookie inspector to review Secure, HttpOnly and SameSite and spot weak settings.

Frequently asked questions

Can I use these tools without installing an extension?

Yes. The five tools on this page work directly in the browser, with no account and no installation. You paste or type the needed details, then read the result. That makes quick checks easier before a release or during a configuration review.

What is the difference between CSP Constructor and the header audit?

CSP Constructor helps you write a Content-Security-Policy, while the audit measures headers already present on a page. One prepares a configuration and the other checks the current state. You can chain them to compare your intended policy with what is observed.

Does Cookie inspector reveal sensitive values?

It shows the attributes of cookies set by a page, such as Secure, HttpOnly and SameSite. This helps spot weak settings. Remember that a cookie value may contain session data, so handle it carefully and avoid sharing it unnecessarily.

In what order should I chain the audit and CSP Constructor?

Start with Security header audit to see what is missing, then move to CSP Constructor to write a suitable policy. Return to Security headers to compare the resulting baseline with the current state. This order prevents drafting a policy without knowing the starting point.

Does CORS tester replace a cookie check?

No. CORS tester checks whether an origin is allowed to call an address, while Cookie inspector reads Secure, HttpOnly and SameSite attributes. These two checks answer different questions. Use them together to cover exchanges and session data.

Tools in the same category