Audit web security headers in seconds.
Analyze. Detect. Harden. Sentinel checks any site for the six baseline HTTP security headers and explains what each one defends against — in plain English, no jargon.
Browsers block cross-origin header reads, so requests route through a public lookup service (allorigins.win). Treat results as a quick check — not a full audit — and don't analyze sensitive URLs. Deploy the bundled backend for private, reliable results.
Six headers. The baseline for any production site.
Security headers are the cheapest defense a server has — they tell the browser how to behave. Missing or misconfigured headers are among the most common findings in real-world audits, because they're invisible to users and easy to overlook.
Paste a URL. Get a graded report.
No build step, no install, no account. Sentinel is plain HTML, CSS, and JavaScript — drop it on any static host.
Paste a URL
Enter any public website. Sentinel normalizes it to HTTPS and validates the address before sending a single request.
Fetch the headers
The request is routed through a CORS proxy so the browser can read the response. Sentinel parses every header it gets back.
Read the grade
Each header is scored Present, Weak, or Missing, with a plain-English note. The site gets a letter grade from A to F.
Closing the loop between building and breaking.
Sentinel started as a single-file tool to answer one question quickly: is this site sending the security headers it should be? It grew out of my move from web development into security.
Web developers ship the apps. Security folks find the gaps. I've spent enough time on the building side to know how often headers get skipped — not out of negligence, but because they're invisible until someone goes looking. Sentinel is how I go looking.
"False confidence is worse than no check. A security tool should be honest about what it doesn't cover."