CSP and HSTS
HTTP checks look for Content-Security-Policy and Strict-Transport-Security. Their presence does not establish that the policy is suitable or that all site responses are protected.
Automated checks on a public URL
Check a page’s security headers
Examine a URL’s HTTP response and the protections it declares to prepare an appropriate correction.
This form runs the existing Argos audit. A missing header is a technical finding; on its own, it does not prove an exploitable vulnerability.
Analyze your page for free
This form runs the existing Argos audit across its four domains. Results include the available checks, their evidence and their limits.
What you can read in the report
Other headers
The catalog examines X-Frame-Options, X-Content-Type-Options, Referrer-Policy and Permissions-Policy, among other headers, as well as observed cookie attributes.
HTTPS and TLS
The final URL, connection and available TLS results complement the HTTP findings. External services may be unavailable; read the report alongside its coverage.
Example: CSP is missing from the response
A fictional HTTPS response from a public atelier.example page. No real site or penetration test.
Illustrative evidence
HTTP/2 200 Content-Type: text/html X-Content-Type-Options: nosniff # Content-Security-Policy missing
How to read it: The http.security.csp check indicates that the header is missing from the observed response. This is not a demonstration of XSS or an exhaustive search for vulnerabilities.
Suggested correction: List the required scripts, styles, images and connections. Prepare a suitable CSP, test it in Report-Only mode in a controlled environment and verify user journeys before enforcing it.
What to check next: Check responses and browser errors after deployment. For HSTS, verify HTTPS on the relevant domains before using includeSubDomains or preload; do not copy a universal policy.
Limits to keep in mind
Argos does not provide a penetration test, an exhaustive vulnerability search or a Supabase/RLS audit here. Protections must match how the site actually works. A high score does not certify its security.