Checker
Security headers check
Paste a public https URL. LeakWatch reads the headers on that page and writes down which of the six common ones are missing. A missing header is low severity. It is hygiene, not proof that data was exposed.
The free report names every finding, with its severity and category. The most serious one is shown in full. The others keep the location, evidence, and fix prompt for the $19 Proof Report. One free scan per network every 30 days.
What this page is for
Content-Security-Policy
Limits where scripts and frames can come from. Without it, one injected script can call your APIs as the visitor.
Strict-Transport-Security
Tells browsers to keep using HTTPS. Checked only when the URL is https.
Framing, nosniff, referrer, and permissions
X-Frame-Options or CSP frame-ancestors, X-Content-Type-Options: nosniff, Referrer-Policy, and Permissions-Policy. Cookie flags and a credentialed CORS wildcard are included in the same scan.
Questions
- Is this a different scan from the homepage?
- No. It is the same free scan, so you also get the key and database checks. It uses the one free scan for your network.
- Will a missing header be marked critical?
- No. Missing security headers are low. A leaked secret or a readable user table is the serious finding.
A Proof Report is $19 once. Monitoring is $9/month. Pro is $29/month. No subscription is required for the report. See pricing.