Security headers,
right from your browser.

Spectra is a Chrome extension that checks 9 HTTP security headers on any website and shows you which are missing, what risks they create, and the exact config to fix them. Results in seconds, no setup required.

Add to Chrome, Free See what it checks →

No account needed. Free to install. All analysis runs locally in your browser.

Spectra on Product Hunt
Spectra
Security Score
— Scanning — / 100
Headers
Cookies PRO
CORS PRO
Header Pts Impact Status
  • X-Frame-Options 15 High Not Set
  • X-Frame-Options Not Set

    Prevents your page from being loaded inside an iframe, blocking clickjacking attacks.

    Nginx Apache Express Next.js 
    add_header X-Frame-Options "DENY" always;
  • Permissions-Policy 7 Medium Not Set
  • Content-Security-Policy 25 Active
  • Strict-Transport-Security 20 Active
  • Referrer-Policy 8 Active
session_id
HttpOnly Secure SameSite=Lax
_ga
Missing HttpOnly: readable by JavaScript (XSS risk)
Missing Secure: sent over plain HTTP
csrf_token
Secure SameSite=Strict
Missing HttpOnly: readable by JavaScript (XSS risk)

What Spectra checks

All analysis runs locally in your browser. Nothing leaves your device.

Cookie Audit Pro

Inspect every cookie for HttpOnly, Secure, and SameSite flags. Issues are listed per cookie so you can see exactly what needs fixing.

CORS Analysis Pro

Detects wildcard origins, credential mismatches, and header misconfigurations in cross-origin policy. Each finding includes severity and a plain English explanation.

Bulk Scanner Pro

Scan up to 30 domains at once in parallel. Results load as they come in. Export the whole run as a PDF report to share with your team.

Security Score

Get an instant A to F grade based on which headers are present and how they are configured. Know where a site stands at a glance.

Header Analysis

Checks 9 security headers including CSP, HSTS, X-Frame-Options, and Permissions-Policy. Missing headers are sorted by severity so you know what to fix first.

Fix Snippets

For every missing header, Spectra gives you ready to paste config for Nginx, Apache, Express, and Next.js. No Googling required.

CSP Analyzer

Breaks down Content Security Policy directives and flags unsafe sources, missing policies, and known bypass patterns. Shows exactly which directive has the issue.

Info Disclosure Detection

Flags response headers that reveal server software and version numbers, like Server and X-Powered-By. Small detail, real attack surface.

HSTS Preload Check

Checks whether the domain is hardcoded into Chrome as HTTPS only via the HSTS preload list. Shows Preloaded, Pending, or Not listed.

Pricing

Free for most things. Pay once for the rest. No subscriptions ever.

Free
₹0

No account needed

  • Security score & grade
  • All 9 header checks
  • CSP deep analysis
  • Fix snippets for 4 stacks
  • HSTS preload check
  • Info disclosure detection
  • Cookie security analysis
  • Full CORS analysis
  • Bulk scanner (30 domains)
  • PDF report export
Add to Chrome
Pro
₹299 one-time

Pay once, use forever. Roughly $3.50 USD.

  • Security score & grade
  • All 9 header checks
  • CSP deep analysis
  • Fix snippets for 4 stacks
  • HSTS preload check
  • Info disclosure detection
  • Cookie security analysis
  • Full CORS analysis
  • Bulk scanner (30 domains)
  • PDF report export

Common questions

Is the free tier really free forever?

Yes. No trial period, no expiry, no credit card. The free tier includes the full header analysis, security score, CSP deep analysis, fix snippets, HSTS preload check, and info disclosure detection. The only things behind Pro are cookie audit, CORS analysis, bulk scanner, and PDF export.

Does it work on all websites?

Spectra reads HTTP response headers from whichever page you have open. It works on any URL Chrome can load, including localhost and internal tools. Some headers are only visible server side so results depend on what the server actually sends.

Is this Chrome only?

Spectra is a Chrome extension. It also works in Chromium based browsers like Microsoft Edge and Brave. Firefox is not supported.

What happens to my data?

Nothing leaves your device. All analysis runs locally in your browser. Spectra reads headers and cookies from the active tab and processes them on device. There are no analytics, no tracking scripts, and no account required.