Use in your browser
Check the eight browser protection headers returned by a public page. See each header's status and value, plus a weighted configuration score. Certificates, TLS settings, and page scripts are outside this check.
Guest includes 50 lifetime app requests. Create a free account for 100 app requests each calendar month. One allowance across every app, in your browser and your agent.One allowance across every app, in your browser and your agent. Manage usage
Guest access is available after setup. Full account linking verified by PowMCP: Claude only.
Connect this app on its own. Add other PowMCP apps whenever your agent needs another job done.
Open the apps workspace
Choose your agent. Each button opens a new tab with only this app's endpoint ready to add.
ClaudeOpen Claude setup Guest access + account linking verified by PowMCP
VS CodeOpen VS Code setup Guest access available · Account linking not yet verified
KiroOpen Kiro setup Guest access available · Account linking not yet verified
LM StudioOpen LM Studio setup Guest access available · Account linking not yet verified
Visual StudioOpen Visual Studio setup (Windows) Guest access available · Account linking not yet verifiedCopy one ready-to-send prompt for any agent that supports remote MCP connections.
For clients that require manual configuration, use this app-only endpoint, its JSON entry, or one terminal command.
ChatGPT: enable Developer mode in Settings → Security and login, then add this MCP endpoint from the Plugins page. Availability depends on your account and workspace policy. PowMCP has not yet verified ChatGPT account linking. OpenAI setup guide
https://powmcp.com/security-headers-check/mcp {
"mcpServers": {
"powmcp-security-headers-check": {
"type": "http",
"url": "https://powmcp.com/security-headers-check/mcp"
}
}
}Terminal agents add this app with one command:
claude mcp add --transport http powmcp-security-headers-check https://powmcp.com/security-headers-check/mcpcodex mcp add powmcp-security-headers-check --url https://powmcp.com/security-headers-check/mcpgemini mcp add --transport http powmcp-security-headers-check https://powmcp.com/security-headers-check/mcpManage, disable, or remove this connection in your agent's own MCP settings. PowMCP does not label an external connection as installed without confirmation from that client.
Proof
Reads the eight industry-standard browser protection headers straight off the live response: each one set or missing, with the value your server actually sent and a weighted header score
Check which browser protection headers a public web page really sends. One guarded request reads the live response and reports all eight industry-standard headers (Content-Security-Policy, Strict-Transport-Security, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, Cross-Origin-Opener-Policy and Cross-Origin-Resource-Policy), each marked set or missing with the value the server returned, plus a header score weighted by how much each header matters. It scores header configuration on one page: it is not a verdict on whether the site is secure.
Request cost1 completed result
Guests get 50 lifetime app requests. Free accounts get 100 each calendar month.
security_headers_check
Reads one public URL's live HTTP response and reports which of the eight industry-standard browser protection headers it sends (Content-Security-Policy, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, Cross-Origin-Opener-Policy and Cross-Origin-Resource-Policy), each marked set or missing with the value returned, plus a header score weighted by how much each header matters. Reach for it whenever the question is about security headers, a header grade from another scanner, a missing Content-Security-Policy or HSTS, or clickjacking, MIME-sniffing and referrer-leak defences. It scores header configuration on the fetched page only: it does not test TLS, certificates, or the JavaScript the page loads, so it cannot tell you whether the site is secure. One request, capped at 15 seconds; measured runs against six live sites landed between 0.04 and 1.1 seconds.
Other apps for the jobs next to Security Headers Check.
Scope and boundaries for Security Headers Check.
Check https://developer.mozilla.org to inspect the browser protection headers returned by the final page after redirects.
Start with finalUrl, then the weighted score and missing entries in headers.status; add the highest-weight missing header first and rerun. A score of 100 means all eight headers were present on that response, not that their values form effective policies, so inspect each returned value separately. This is a header-presence check, not a TLS or overall security verdict.
The score describes eight headers on one fetched response and is not a verdict that the site is secure. It does not inspect TLS or certificates, loaded JavaScript, application vulnerabilities, or headers returned by other pages and resources; displayed header values are truncated to 160 characters.