A Privacy Policy Short Enough to Read

What Happens When You Check a URL

When you submit a URL to the checker, this site's server fetches it once, following redirects, and grades the headers of the final response in memory. Nothing is stored as a personal history, a searchable archive, a leaderboard or a dataset of checked sites. The URL you entered travels in the report page's address so you can reload or share it; it is not logged beyond the web server's standard access log. The request carries a user agent that names this tool, so the site you check can see that a request came from securityheaders.tools; it cannot see who asked for it.

The generator never leaves your browser

The generator is plain client-side JavaScript. The hosts you type, the policy it builds and the file you copy or download are never transmitted to this server or anyone else.

Cookies and storage on this site

This site sets no cookies for the product. It keeps nothing in localStorage or sessionStorage. There is no login and no preference to remember.

Page views are measured with Google Analytics, which sets its own first-party cookies (_ga and _ga_*) and sends the page address, a random client identifier and technical details about your browser to Google. The data is used only to see which pages get read. Google's handling of it is described in the Google privacy policy. Browsers with a Global Privacy Control signal, an ad blocker or scripts disabled are not measured.

Third parties this site touches

Fonts load from Google Fonts, which means your browser requests font files from Google's servers as described in the Google privacy policy. No ad networks or tracking pixels load here. The server does what any web server does: it delivers the page files and may write standard, short-lived access logs handled by the hosting provider. Rate limiting keeps a hashed, temporary count of requests per visitor address so the fetcher cannot be abused; those counters expire within the hour.

How to clear local data

There is nothing to clear on this site. The report address contains the URL you checked, so clearing your browser history removes that trace. If you emailed a URL to the contact address for debugging, say the word and that email gets deleted too.

If this policy ever changes, the date above changes with it, and the substance will stay consistent with the terms of use.