Your headers are
talking. Are they
saying the right things?

Point this at a site and it reads the raw HTTP response headers — the same ones every browser sees — and checks them against the defenses that stop clickjacking, script injection, and data leaks.

Use responsibly. Only scan domains you own or have explicit permission to test. This sends one ordinary GET request — nothing more.