{"id":13428,"date":"2026-08-31T15:31:20","date_gmt":"2026-08-31T13:31:20","guid":{"rendered":"https:\/\/www.lukaswojcik.com\/blog\/narzedzia\/http-security-header-checker\/"},"modified":"2026-08-31T15:31:20","modified_gmt":"2026-08-31T13:31:20","slug":"http-security-header-checker","status":"publish","type":"page","link":"https:\/\/www.lukaswojcik.com\/blog\/pl\/narzedzia\/http-security-header-checker\/","title":{"rendered":"Kontroler nag\u0142\u00f3wk\u00f3w bezpiecze\u0144stwa HTTP"},"content":{"rendered":"<div class=\"gtm-analyser-container\" style=\"background: var(--bg-panel, #1e1e24); padding: 25px; border-radius: 8px; border: 1px solid var(--border, #2a2a35);\">\n<p style=\"color: var(--text-secondary, #a0a0b0); margin-bottom: 20px;\">Nag\u0142\u00f3wki bezpiecze\u0144stwa \u0142atwo ustawi\u0107 i r\u00f3wnie \u0142atwo ustawi\u0107 bezu\u017cytecznie. Content-Security-Policy dopuszczaj\u0105ca unsafe-inline jest obecna i wobec ataku, dla kt\u00f3rego istnieje, nie wsk\u00f3ra nic. Tutaj odczytywane jest to, co adres naprawd\u0119 odsy\u0142a, i oceniany skutek, a nie samo istnienie.<\/p>\n<div style=\"margin-bottom: 14px;\">\n        <label for=\"hc-url\" style=\"color: var(--text-secondary, #a0a0b0); display: block; font-size: 0.85rem; margin-bottom: 5px;\">Adres<\/label><br \/>\n        <input id=\"hc-url\" type=\"text\" value=\"https:\/\/example.com\/\" class=\"form-control\" style=\"width: 100%; padding: 10px; background: var(--bg-body, #14141a); border: 1px solid var(--border, #2a2a35); color: var(--text-primary, #e8e8ee); border-radius: 6px; box-sizing: border-box; font-family: monospace;\">\n    <\/div>\n<p style=\"color: var(--text-secondary, #a0a0b0); font-size: 0.82rem; margin-bottom: 16px;\">Adres jest pobierany raz z tego serwera, zwyk\u0142ym GET i bez cookies. \u017b\u0105dania do sieci prywatnych, do p\u0119tli zwrotnej i do adres\u00f3w link-local s\u0105 odrzucane, tak\u017ce przez przekierowania. Zapytanie chroni reCAPTCHA v3; wywo\u0142uj\u0105cy adres IP oraz cel s\u0105 przechowywane przez godzin\u0119 w celu ograniczenia cz\u0119stotliwo\u015bci.<\/p>\n<p>    <button id=\"hc-btn\" class=\"button\" style=\"background: var(--accent, #7ee787); color: var(--on-accent, #0b1114); border: none; padding: 12px 24px; border-radius: 6px; font-weight: 700; cursor: pointer;\">Sprawd\u017a nag\u0142\u00f3wki<\/button><\/p>\n<div id=\"hc-ausgabe\" style=\"margin-top: 22px;\"><\/div>\n<\/div>\n<p><script>\n(function () {\n    'use strict';<\/p>\n<p>    const T = {\"einleitung\":\"Nag\u0142\u00f3wki bezpiecze\u0144stwa \u0142atwo ustawi\u0107 i r\u00f3wnie \u0142atwo ustawi\u0107 bezu\u017cytecznie. Content-Security-Policy dopuszczaj\u0105ca unsafe-inline jest obecna i wobec ataku, dla kt\u00f3rego istnieje, nie wsk\u00f3ra nic. Tutaj odczytywane jest to, co adres naprawd\u0119 odsy\u0142a, i oceniany skutek, a nie samo istnienie.\",\"label_url\":\"Adres\",\"datenschutz\":\"Adres jest pobierany raz z tego serwera, zwyk\u0142ym GET i bez cookies. \u017b\u0105dania do sieci prywatnych, do p\u0119tli zwrotnej i do adres\u00f3w link-local s\u0105 odrzucane, tak\u017ce przez przekierowania. Zapytanie chroni reCAPTCHA v3; wywo\u0142uj\u0105cy adres IP oraz cel s\u0105 przechowywane przez godzin\u0119 w celu ograniczenia cz\u0119stotliwo\u015bci.\",\"knopf\":\"Sprawd\u017a nag\u0142\u00f3wki\",\"laeuft\":\"Nag\u0142\u00f3wki s\u0105 pobierane...\",\"h_uebersicht\":\"Przegl\u0105d\",\"zeile_endziel\":\"Wyl\u0105dowano na\",\"zeile_status\":\"Status\",\"zeile_spruenge\":\"Przekierowania\",\"zeile_rahmen\":\"Ochrona przed ramkowaniem\",\"zeile_dauer\":\"Czas\",\"ampel_gut\":\"skuteczny\",\"ampel_teilweise\":\"obecny, os\u0142abiony\",\"ampel_fehlt\":\"brak\",\"urteil_geschlossen\":\"Wszystkie cztery maj\u0105 wag\u0119.\",\"urteil_halb\":\"Co\u015b jest ustawione, a co najmniej jedno z tego nie robi tego, na co wygl\u0105da.\",\"urteil_offen\":\"\u017baden z czterech nie jest skuteczny.\",\"h_csp\":\"Content-Security-Policy\",\"csp_keine\":\"Brak polityki. Ka\u017cdy skrypt, kt\u00f3ry strona \u0142aduje, wykonuje si\u0119, sk\u0105dkolwiek pochodzi.\",\"csp_nur_bericht_hinweis\":\"Ta polityka jest ustawiona tylko w trybie raportowania. Zg\u0142asza naruszenia i niczemu nie zapobiega.\",\"h_hsts\":\"Strict-Transport-Security\",\"hsts_keine\":\"Brak HSTS. Pierwsze \u017c\u0105danie po http dociera do serwera, zanim przekierowanie zd\u0105\u017cy pom\u00f3c.\",\"zeile_maxage\":\"max-age\",\"einheit_sekunden\":\"sekund\",\"einheit_tage\":\"dni\",\"h_kopfzeilen\":\"Nag\u0142\u00f3wki tak, jak przychodz\u0105\",\"kopfzeilen_keine\":\"\u017baden z istotnych nag\u0142\u00f3wk\u00f3w nie jest obecny.\",\"h_cookies\":\"Cookies z odpowiedzi\",\"spalte_name\":\"Nazwa\",\"h_befunde\":\"Ustalenia\",\"ja\":\"tak\",\"nein\":\"nie\",\"wert_keiner\":\"brak\",\"wert_leer\":\"pusto\",\"fehler_kein_token\":\"Kontroli nie da\u0142o si\u0119 uruchomi\u0107, bo reCAPTCHA si\u0119 nie wczyta\u0142a.\",\"fehler_captcha\":\"reCAPTCHA uzna\u0142a \u017c\u0105danie za zautomatyzowane. Zwykle pomaga ponowne wczytanie strony.\",\"fehler_zu_viele\":\"Limit {limit} sprawdze\u0144 na godzin\u0119 dla tego adresu zosta\u0142 osi\u0105gni\u0119ty.\",\"fehler_adresse\":\"Tego adresu nie da si\u0119 u\u017cy\u0107.\",\"fehler_zaehler\":\"Licznik jest niedost\u0119pny, wi\u0119c nic nie zosta\u0142o pobrane.\",\"fehler_pruefdienst\":\"Us\u0142uga reCAPTCHA by\u0142a nieosi\u0105galna.\",\"fehler_aufbau\":\"Us\u0142uga nie jest poprawnie skonfigurowana. Wina le\u017cy po tej stronie.\",\"fehler_eingabe\":\"Nie uda\u0142o si\u0119 odczyta\u0107 \u017c\u0105dania.\",\"fehler_methode\":\"Niew\u0142a\u015bciwa metoda \u017c\u0105dania.\",\"fehler_netz\":\"Us\u0142uga by\u0142a nieosi\u0105galna.\",\"fehler_antwort\":\"Nie uda\u0142o si\u0119 odczyta\u0107 odpowiedzi.\",\"fehler_abruf\":\"Nie uda\u0142o si\u0119 pobra\u0107 adresu.\",\"fehler_unbekannt\":\"Co\u015b posz\u0142o nie tak, na co nie ma osobnego komunikatu.\",\"grund_leer\":\"Nic nie zosta\u0142o wpisane.\",\"grund_zu_lang\":\"Adres jest za d\u0142ugi.\",\"grund_unlesbar\":\"Tego nie da si\u0119 odczyta\u0107 jako adresu sieciowego.\",\"grund_schema\":\"Pobierane s\u0105 tylko http i https.\",\"grund_benutzerinfo\":\"Adresy z danymi dost\u0119powymi s\u0105 odrzucane.\",\"grund_kein_punkt\":\"Nazwa hosta potrzebuje co najmniej jednej kropki.\",\"grund_hostform\":\"Nazwa hosta ma nieu\u017cyteczn\u0105 posta\u0107.\",\"grund_port\":\"Pobierane s\u0105 tylko porty 80, 443, 8080 i 8443.\",\"grund_gesperrter_bereich\":\"Ten adres wskazuje na sie\u0107 prywatn\u0105 albo zarezerwowan\u0105. Takie nigdy nie s\u0105 pobierane, tak\u017ce przez przekierowanie.\",\"grund_kein_dns\":\"Nazwa hosta si\u0119 nie rozwi\u0105zuje.\",\"grund_zu_viele_spruenge\":\"Za du\u017co przekierowa\u0144.\",\"befund_csp_fehlt\":\"Brak Content-Security-Policy. Nic nie ogranicza, sk\u0105d mog\u0105 pochodzi\u0107 skrypty.\",\"befund_csp_unsafe_inline\":\"script-src dopuszcza \\u0027unsafe-inline\\u0027. Skrypt osadzony to dok\u0142adnie to, co wstrzykuje atak cross-site scripting - polityka jest wi\u0119c obecna i wobec tego, po co istnieje, bezz\u0119bna.\",\"befund_csp_unsafe_eval\":\"script-src dopuszcza \\u0027unsafe-eval\\u0027. Ci\u0105g znak\u00f3w mo\u017ce dzi\u0119ki temu zn\u00f3w sta\u0107 si\u0119 kodem, co otwiera jedn\u0105 z dr\u00f3g, kt\u00f3re polityka zamyka.\",\"befund_csp_platzhalter\":\"\u0179r\u00f3d\u0142em skrypt\u00f3w jest symbol wieloznaczny - *, https: albo data:. To dopuszcza praktycznie ka\u017cde pochodzenie.\",\"befund_csp_nonce_neben_inline\":\"Nonce stoi obok \\u0027unsafe-inline\\u0027. Przegl\u0105darki rozumiej\u0105ce nonce pomijaj\u0105 unsafe-inline; starsze nie. Dla cz\u0119\u015bci odbiorc\u00f3w rozstrzyga wtedy s\u0142absza regu\u0142a.\",\"befund_csp_ohne_frame_ancestors\":\"Brak frame-ancestors. Strona mo\u017ce by\u0107 ramkowana, o ile X-Frame-Options nie m\u00f3wi inaczej.\",\"befund_csp_ohne_object_src\":\"Brak object-src. \\u0027none\\u0027 w tym miejscu jest tanie i zamyka tre\u015bci wtyczek jako drog\u0119.\",\"befund_csp_ohne_skriptregel\":\"Ani default-src, ani script-src. Polityka nie m\u00f3wi nic o skryptach.\",\"befund_csp_nur_bericht\":\"Polityka dzia\u0142a w trybie raportowania. Niczemu nie zapobiega.\",\"befund_hsts_fehlt\":\"Brak Strict-Transport-Security. Pierwsze wywo\u0142anie po http dociera do serwera, zanim przekierowanie zdo\u0142a zadzia\u0142a\u0107.\",\"befund_hsts_kurz\":\"max-age jest poni\u017cej p\u00f3\u0142 roku. Przegl\u0105darki zapominaj\u0105 regu\u0142\u0119, zanim zd\u0105\u017cy wiele pom\u00f3c.\",\"befund_hsts_ohne_subdomains\":\"Bez includeSubDomains regu\u0142a obejmuje tylko tego hosta. Zapomniana subdomena pozostaje osi\u0105galna po http.\",\"befund_rahmen_ungeschuetzt\":\"Ani frame-ancestors, ani X-Frame-Options. Strona mo\u017ce zosta\u0107 osadzona w obcej ramce.\",\"befund_xfo_neben_ancestors\":\"X-Frame-Options stoi obok frame-ancestors. Przegl\u0105darki rozumiej\u0105ce polityk\u0119 pomijaj\u0105 starszy nag\u0142\u00f3wek; para nie szkodzi, ale jedno z nich jest martwym ci\u0119\u017carem.\",\"befund_referrer_fehlt\":\"Brak Referrer-Policy. Przegl\u0105darki stosuj\u0105 wtedy w\u0142asn\u0105 warto\u015b\u0107 domy\u015bln\u0105, a ta wypada r\u00f3\u017cnie.\",\"befund_referrer_freizuegig\":\"Polityka przekazuje pe\u0142ny adres dalej. \u015acie\u017cki i parametry zapytania w\u0119druj\u0105 do ka\u017cdej strony trzeciej, kt\u00f3r\u0105 \u0142aduje strona.\",\"befund_nosniff_fehlt\":\"Brak X-Content-Type-Options: nosniff. Przegl\u0105darka mo\u017ce wtedy zgadn\u0105\u0107 inny typ ni\u017c zadeklarowany.\",\"befund_permissions_fehlt\":\"Brak Permissions-Policy. Kamera, mikrofon i lokalizacja pozostaj\u0105 domy\u015blnie dost\u0119pne dla tre\u015bci osadzonych.\",\"befund_server_version\":\"Nag\u0142\u00f3wek Server podaje wersj\u0119. To darmowa wskaz\u00f3wka dla ka\u017cdego, kto szuka pasuj\u0105cej podatno\u015bci.\",\"befund_powered_by\":\"X-Powered-By podaje wersj\u0119.\",\"befund_powered_by_da\":\"X-Powered-By jest w og\u00f3le wysy\u0142any. Dla odwiedzaj\u0105cej nie ma to \u017cadnego celu.\",\"befund_cookie_ohne_secure\":\"Cookie jest ustawiane bez Secure. W\u0119druje tym samym tak\u017ce po po\u0142\u0105czeniu nieszyfrowanym.\",\"befund_cookie_ohne_samesite\":\"Cookie jest ustawiane bez SameSite. Przegl\u0105darki stosuj\u0105 w\u0142asn\u0105 warto\u015b\u0107 domy\u015bln\u0105, a ta wypada r\u00f3\u017cnie.\",\"befund_cookie_none_ohne_secure\":\"Cookie niesie SameSite=None bez Secure. Przegl\u0105darki odrzucaj\u0105 t\u0119 kombinacj\u0119 wprost, wi\u0119c cookie po prostu przepada.\"};<\/p>\n<p>    var ENDPUNKT = '\/lw-headercheck.php';\n    var SITEKEY = '6LcrPkEtAAAAAPo1QCOf-IIM2fCL0UfdJz4y2iSY';\n    var HSTS_HALBJAHR = 15768000;<\/p>\n<p>    \/\/ Kopfzeilen, deren Wert die Ausgabe unver\u00e4ndert zeigt.\n    var ZEIGEN = ['strict-transport-security', 'x-frame-options', 'referrer-policy',\n        'permissions-policy', 'x-content-type-options', 'cross-origin-opener-policy',\n        'cross-origin-embedder-policy', 'cross-origin-resource-policy', 'server', 'x-powered-by'];<\/p>\n<p>    \/\/ =========================================================================\n    \/\/ Bewertung - rein\n    \/\/ =========================================================================<\/p>\n<p>    function liste(w) { return Array.isArray(w) ? w : []; }\n    function zahl(w) { return (typeof w === 'number' && isFinite(w)) ? w : null; }<\/p>\n<p>    function bewerten(antwort) {\n        var a = antwort || {};\n        if (a.fehler) {\n            return { fehler: a.fehler, grund: a.grund || null, limit: zahl(a.limit), kette: liste(a.kette) };\n        }\n        var kopf = (a.kopf && typeof a.kopf === 'object' && !Array.isArray(a.kopf)) ? a.kopf : {};\n        var bau = (a.bausteine && typeof a.bausteine === 'object') ? a.bausteine : {};\n        var csp = (a.csp && typeof a.csp === 'object') ? a.csp : null;\n        var hsts = (a.hsts && typeof a.hsts === 'object') ? a.hsts : null;<\/p>\n<p>        var gezeigt = [];\n        ZEIGEN.forEach(function (n) {\n            if (typeof kopf[n] === 'string' && kopf[n] !== '') { gezeigt.push({ name: n, wert: kopf[n] }); }\n        });<\/p>\n<p>        var direktiven = [];\n        if (csp && csp.direktiven && typeof csp.direktiven === 'object') {\n            Object.keys(csp.direktiven).forEach(function (d) {\n                direktiven.push({ name: d, quellen: liste(csp.direktiven[d]) });\n            });\n        }<\/p>\n<p>        return {\n            fehler: null,\n            url: a.url || '', endziel: a.endziel || a.url || '',\n            status: zahl(a.status), dauer: zahl(a.dauer_ms), kette: liste(a.kette),\n            bausteine: {\n                csp: bau.csp || 'fehlt', hsts: bau.hsts || 'fehlt',\n                rahmen: bau.rahmen || 'fehlt', referrer: bau.referrer || 'fehlt'\n            },\n            urteil: a.urteil || 'offen',\n            cspSatz: (kopf['content-security-policy'] || kopf['content-security-policy-report-only'] || null),\n            cspNurBericht: !!(csp && csp.nur_bericht),\n            direktiven: direktiven,\n            hsts: hsts ? {\n                maxAge: zahl(hsts.max_age), subdomains: !!hsts.subdomains,\n                preload: !!hsts.preload,\n                kurz: (zahl(hsts.max_age) === null || hsts.max_age < HSTS_HALBJAHR)\n            } : null,\n            kopfzeilen: gezeigt,\n            cookies: liste(a.cookies),\n            befunde: liste(a.befunde)\n        };\n    }\n\n    \/\/ =========================================================================\n    \/\/ Abruf\n    \/\/ =========================================================================\n\n    function skriptLaden() {\n        return new Promise(function (auf) {\n            if (window.grecaptcha) { auf(true); return; }\n            var s = document.createElement('script');\n            s.src = 'https:\/\/www.google.com\/recaptcha\/api.js?render=' + SITEKEY;\n            s.onload = function () { auf(true); };\n            s.onerror = function () { auf(false); };\n            document.head.appendChild(s);\n            setTimeout(function () { auf(!!window.grecaptcha); }, 8000);\n        });\n    }\n    \/** grecaptcha.ready abwarten - execute ist bei onload noch nicht da. *\/\n    function tokenHolen() {\n        return skriptLaden().then(function (da) {\n            if (!da || !window.grecaptcha || !window.grecaptcha.ready) { return null; }\n            return new Promise(function (auf) {\n                var fertig = false;\n                function einmal(w) { if (!fertig) { fertig = true; auf(w); } }\n                setTimeout(function () { einmal(null); }, 12000);\n                try {\n                    window.grecaptcha.ready(function () {\n                        if (fertig) { return; }\n                        if (!window.grecaptcha.execute) { einmal(null); return; }\n                        window.grecaptcha.execute(SITEKEY, { action: 'headercheck' })\n                            .then(function (t) { einmal(t || null); }, function () { einmal(null); });\n                    });\n                } catch (e) { einmal(null); }\n            });\n        }, function () { return null; });\n    }\n    function abfragen(url) {\n        return tokenHolen().then(function (token) {\n            return fetch(ENDPUNKT, {\n                method: 'POST', headers: { 'Content-Type': 'application\/json' },\n                body: JSON.stringify({ url: url, token: token || '' })\n            }).then(function (r) {\n                return r.json().then(function (j) { return j; }, function () { return { fehler: 'antwort' }; });\n            }, function () { return { fehler: 'netz' }; });\n        });\n    }\n\n    window.LW_TEST = window.LW_TEST || {};\n    window.LW_TEST.HC = { bewerten: bewerten, darstellen: null, ENDPUNKT: ENDPUNKT, ZEIGEN: ZEIGEN, T: T };\n\n    \/\/ =========================================================================\n    \/\/ Oberflaeche\n    \/\/ =========================================================================\n\n    var btn = document.getElementById('hc-btn');\n    var out = document.getElementById('hc-ausgabe');\n    if (!btn || !out) { return; }\n\n    function el(tag, stil, text) {\n        var e = document.createElement(tag);\n        if (stil) { e.setAttribute('style', stil); }\n        if (text !== undefined) { e.textContent = text; }\n        return e;\n    }\n    function wert(id) { var e = document.getElementById(id); return e ? e.value : ''; }\n\n    var UEBERSCHRIFT = 'font-family: \"Nunito Sans\", sans-serif; font-weight: 700; color: var(--text-primary, #e8e8ee); font-size: 0.92rem; margin: 18px 0 8px;';\n    var ZELLE = 'padding: 5px 12px 5px 0; color: var(--text-secondary, #a0a0b0); font-size: 0.87rem;';\n    var ZELLE_WERT = 'padding: 5px 12px 5px 0; color: var(--text-primary, #e8e8ee); font-size: 0.87rem; font-family: monospace; word-break: break-all;';\n    var VORFORM = 'background: var(--bg-body, #14141a); border: 1px solid var(--border, #2a2a35); border-radius: 6px; padding: 10px; color: var(--text-primary, #e8e8ee); font-family: monospace; font-size: 0.78rem; white-space: pre-wrap; word-break: break-all; margin: 0;';\n    var GUT = ' color: #7ee787;';\n    var WARN = ' color: #ffa94d;';\n    var GRAU = ' color: #8a8a99;';\n\n    function farbe(a) { return a === 'gut' ? GUT : WARN; }\n    function gitter(sp) {\n        return el('div', 'display: grid; grid-template-columns: ' + sp + '; gap: 0 18px; align-items: baseline;');\n    }\n    function paar(g, n, w, stil) {\n        g.appendChild(el('div', ZELLE, n));\n        g.appendChild(el('div', ZELLE_WERT + (stil || ''), w));\n    }\n    function kopfZeile(g, sp) {\n        sp.forEach(function (s) {\n            g.appendChild(el('div', ZELLE + ' font-weight: 700; color: var(--text-primary, #e8e8ee);', s));\n        });\n    }\n\n    function darstellen(b, ziel) {\n        ziel.innerHTML = '';\n        if (b.fehler) {\n            var text = T['fehler_' + b.fehler] || T.fehler_unbekannt;\n            if (b.grund &#038;&#038; T['grund_' + b.grund]) { text = text + ' ' + T['grund_' + b.grund]; }\n            if (b.limit !== null) { text = text.replace('{limit}', String(b.limit)); }\n            ziel.appendChild(el('p', ZELLE + WARN + ' margin: 0;', text));\n            return;\n        }\n\n        ziel.appendChild(el('div', UEBERSCHRIFT, T.h_uebersicht));\n        var g = gitter('auto auto');\n        paar(g, T.zeile_endziel, b.endziel);\n        paar(g, T.zeile_status, String(b.status === null ? '-' : b.status));\n        if (b.kette.length > 1) { paar(g, T.zeile_spruenge, String(b.kette.length - 1), WARN); }\n        paar(g, 'Content-Security-Policy', T['ampel_' + b.bausteine.csp], farbe(b.bausteine.csp));\n        paar(g, 'Strict-Transport-Security', T['ampel_' + b.bausteine.hsts], farbe(b.bausteine.hsts));\n        paar(g, T.zeile_rahmen, T['ampel_' + b.bausteine.rahmen], farbe(b.bausteine.rahmen));\n        paar(g, 'Referrer-Policy', T['ampel_' + b.bausteine.referrer], farbe(b.bausteine.referrer));\n        if (b.dauer !== null) { paar(g, T.zeile_dauer, b.dauer + ' ms', GRAU); }\n        ziel.appendChild(g);\n        ziel.appendChild(el('div', 'margin: 10px 0 0; font-size: 0.9rem; font-weight: 700;'\n            + (b.urteil === 'geschlossen' ? GUT : WARN), T['urteil_' + b.urteil]));<\/p>\n<p>        \/\/ --- CSP ---\n        ziel.appendChild(el('div', UEBERSCHRIFT, T.h_csp));\n        if (!b.cspSatz) {\n            ziel.appendChild(el('p', ZELLE + WARN + ' margin: 0;', T.csp_keine));\n        } else {\n            if (b.cspNurBericht) {\n                ziel.appendChild(el('p', ZELLE + WARN + ' margin: 0 0 8px;', T.csp_nur_bericht_hinweis));\n            }\n            ziel.appendChild(el('pre', VORFORM, b.cspSatz));\n            if (b.direktiven.length) {\n                var gd = gitter('auto auto');\n                b.direktiven.forEach(function (d) {\n                    paar(gd, d.name, d.quellen.length ? d.quellen.join(' ') : T.wert_leer, GRAU);\n                });\n                ziel.appendChild(gd);\n            }\n        }<\/p>\n<p>        \/\/ --- HSTS ---\n        ziel.appendChild(el('div', UEBERSCHRIFT, T.h_hsts));\n        if (!b.hsts) {\n            ziel.appendChild(el('p', ZELLE + WARN + ' margin: 0;', T.hsts_keine));\n        } else {\n            var gh = gitter('auto auto');\n            paar(gh, T.zeile_maxage, (b.hsts.maxAge === null ? '-' : b.hsts.maxAge + ' ' + T.einheit_sekunden)\n                + (b.hsts.maxAge !== null ? '  (' + Math.round(b.hsts.maxAge \/ 86400) + ' ' + T.einheit_tage + ')' : ''),\n                b.hsts.kurz ? WARN : GUT);\n            paar(gh, 'includeSubDomains', b.hsts.subdomains ? T.ja : T.nein, b.hsts.subdomains ? GUT : WARN);\n            paar(gh, 'preload', b.hsts.preload ? T.ja : T.nein, GRAU);\n            ziel.appendChild(gh);\n        }<\/p>\n<p>        \/\/ --- Weitere Kopfzeilen ---\n        ziel.appendChild(el('div', UEBERSCHRIFT, T.h_kopfzeilen));\n        if (!b.kopfzeilen.length) {\n            ziel.appendChild(el('p', ZELLE + ' margin: 0;', T.kopfzeilen_keine));\n        } else {\n            var gk = gitter('auto auto');\n            b.kopfzeilen.forEach(function (z) { paar(gk, z.name, z.wert, GRAU); });\n            ziel.appendChild(gk);\n        }<\/p>\n<p>        \/\/ --- Cookies ---\n        if (b.cookies.length) {\n            ziel.appendChild(el('div', UEBERSCHRIFT, T.h_cookies));\n            var gc = gitter('auto auto auto auto');\n            kopfZeile(gc, [T.spalte_name, 'Secure', 'HttpOnly', 'SameSite']);\n            b.cookies.forEach(function (c) {\n                gc.appendChild(el('div', ZELLE_WERT, c.name || '-'));\n                gc.appendChild(el('div', ZELLE + (c.secure ? GUT : WARN), c.secure ? T.ja : T.nein));\n                gc.appendChild(el('div', ZELLE + GRAU, c.httponly ? T.ja : T.nein));\n                gc.appendChild(el('div', ZELLE + (c.samesite ? '' : WARN), c.samesite || T.wert_keiner));\n            });\n            ziel.appendChild(gc);\n        }<\/p>\n<p>        \/\/ --- Befunde ---\n        if (b.befunde.length) {\n            ziel.appendChild(el('div', UEBERSCHRIFT, T.h_befunde));\n            var l = el('ul', 'margin: 0 0 0 18px; padding: 0; color: var(--text-secondary, #a0a0b0); font-size: 0.87rem; line-height: 1.65;');\n            b.befunde.forEach(function (f) {\n                var t = T['befund_' + f];\n                if (t) { l.appendChild(el('li', '', t)); }\n            });\n            ziel.appendChild(l);\n        }\n    }\n    window.LW_TEST.HC.darstellen = darstellen;<\/p>\n<p>    var laeuft = false;\n    btn.addEventListener('click', function () {\n        if (laeuft) { return; }\n        laeuft = true; btn.disabled = true;\n        out.innerHTML = '';\n        out.appendChild(el('p', ZELLE + GRAU + ' margin: 0;', T.laeuft));\n        abfragen(wert('hc-url')).then(function (a) {\n            darstellen(bewerten(a), out); laeuft = false; btn.disabled = false;\n        }, function () {\n            darstellen(bewerten({ fehler: 'netz' }), out); laeuft = false; btn.disabled = false;\n        });\n    });\n})();\n<\/script><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Odczytuje nag\u0142\u00f3wki odpowiedzi adresu i m\u00f3wi, co one faktycznie robi\u0105: polityka z unsafe-inline jest obecna i bezz\u0119bna, HSTS na pi\u0119\u0107 minut nikogo nie chroni, a brakuj\u0105ca regu\u0142a ramek to brakuj\u0105ca regu\u0142a ramek.<\/p>\n","protected":false},"author":1,"featured_media":0,"parent":9284,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"template-tool-base.php","meta":{"footnotes":""},"tags":[92151,92229,92077],"class_list":["post-13428","page","type-page","status-publish","hentry","tag-prywatnosc-danych-pl-pl","tag-devops-pl","tag-web-security-pl"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.1 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Kontroler nag\u0142\u00f3wk\u00f3w bezpiecze\u0144stwa HTTP - Lukas Wojcik - Blog<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.lukaswojcik.com\/blog\/pl\/narzedzia\/http-security-header-checker\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Kontroler nag\u0142\u00f3wk\u00f3w bezpiecze\u0144stwa HTTP - Lukas Wojcik - Blog\" \/>\n<meta property=\"og:description\" content=\"Odczytuje nag\u0142\u00f3wki odpowiedzi adresu i m\u00f3wi, co one faktycznie robi\u0105: polityka z unsafe-inline jest obecna i bezz\u0119bna, HSTS na pi\u0119\u0107 minut nikogo nie chroni, a brakuj\u0105ca regu\u0142a ramek to brakuj\u0105ca regu\u0142a ramek.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.lukaswojcik.com\/blog\/pl\/narzedzia\/http-security-header-checker\/\" \/>\n<meta property=\"og:site_name\" content=\"Lukas Wojcik - Blog\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.lukaswojcik.com\/blog\/wp-content\/uploads\/2026\/08\/og-default.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1200\" \/>\n\t<meta property=\"og:image:height\" content=\"630\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data1\" content=\"1 minute\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/pl\\\/narzedzia\\\/http-security-header-checker\\\/\",\"url\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/pl\\\/narzedzia\\\/http-security-header-checker\\\/\",\"name\":\"Kontroler nag\u0142\u00f3wk\u00f3w bezpiecze\u0144stwa HTTP - Lukas Wojcik - Blog\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/#website\"},\"datePublished\":\"2026-08-31T13:31:20+00:00\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/pl\\\/narzedzia\\\/http-security-header-checker\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/pl\\\/narzedzia\\\/http-security-header-checker\\\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/pl\\\/narzedzia\\\/http-security-header-checker\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Toolbox\",\"item\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/toolbox-3\\\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"Kontroler nag\u0142\u00f3wk\u00f3w bezpiecze\u0144stwa HTTP\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/\",\"name\":\"Lukas Wojcik - Blog\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/#\\\/schema\\\/person\\\/895f7604f9b6b71aad9bba33af28d0f9\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":[\"Person\",\"Organization\"],\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/#\\\/schema\\\/person\\\/895f7604f9b6b71aad9bba33af28d0f9\",\"name\":\"luky\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/07\\\/lw-x2.jpg\",\"url\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/07\\\/lw-x2.jpg\",\"contentUrl\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/07\\\/lw-x2.jpg\",\"width\":424,\"height\":636,\"caption\":\"luky\"},\"logo\":{\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/07\\\/lw-x2.jpg\"},\"sameAs\":[\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\"]}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Kontroler nag\u0142\u00f3wk\u00f3w bezpiecze\u0144stwa HTTP - Lukas Wojcik - Blog","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.lukaswojcik.com\/blog\/pl\/narzedzia\/http-security-header-checker\/","og_locale":"en_US","og_type":"article","og_title":"Kontroler nag\u0142\u00f3wk\u00f3w bezpiecze\u0144stwa HTTP - Lukas Wojcik - Blog","og_description":"Odczytuje nag\u0142\u00f3wki odpowiedzi adresu i m\u00f3wi, co one faktycznie robi\u0105: polityka z unsafe-inline jest obecna i bezz\u0119bna, HSTS na pi\u0119\u0107 minut nikogo nie chroni, a brakuj\u0105ca regu\u0142a ramek to brakuj\u0105ca regu\u0142a ramek.","og_url":"https:\/\/www.lukaswojcik.com\/blog\/pl\/narzedzia\/http-security-header-checker\/","og_site_name":"Lukas Wojcik - Blog","og_image":[{"width":1200,"height":630,"url":"https:\/\/www.lukaswojcik.com\/blog\/wp-content\/uploads\/2026\/08\/og-default.jpg","type":"image\/jpeg"}],"twitter_card":"summary_large_image","twitter_misc":{"Est. reading time":"1 minute"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/www.lukaswojcik.com\/blog\/pl\/narzedzia\/http-security-header-checker\/","url":"https:\/\/www.lukaswojcik.com\/blog\/pl\/narzedzia\/http-security-header-checker\/","name":"Kontroler nag\u0142\u00f3wk\u00f3w bezpiecze\u0144stwa HTTP - Lukas Wojcik - Blog","isPartOf":{"@id":"https:\/\/www.lukaswojcik.com\/blog\/#website"},"datePublished":"2026-08-31T13:31:20+00:00","breadcrumb":{"@id":"https:\/\/www.lukaswojcik.com\/blog\/pl\/narzedzia\/http-security-header-checker\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.lukaswojcik.com\/blog\/pl\/narzedzia\/http-security-header-checker\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.lukaswojcik.com\/blog\/pl\/narzedzia\/http-security-header-checker\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.lukaswojcik.com\/blog\/"},{"@type":"ListItem","position":2,"name":"Toolbox","item":"https:\/\/www.lukaswojcik.com\/blog\/toolbox-3\/"},{"@type":"ListItem","position":3,"name":"Kontroler nag\u0142\u00f3wk\u00f3w bezpiecze\u0144stwa HTTP"}]},{"@type":"WebSite","@id":"https:\/\/www.lukaswojcik.com\/blog\/#website","url":"https:\/\/www.lukaswojcik.com\/blog\/","name":"Lukas Wojcik - Blog","description":"","publisher":{"@id":"https:\/\/www.lukaswojcik.com\/blog\/#\/schema\/person\/895f7604f9b6b71aad9bba33af28d0f9"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.lukaswojcik.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":["Person","Organization"],"@id":"https:\/\/www.lukaswojcik.com\/blog\/#\/schema\/person\/895f7604f9b6b71aad9bba33af28d0f9","name":"luky","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.lukaswojcik.com\/blog\/wp-content\/uploads\/2026\/07\/lw-x2.jpg","url":"https:\/\/www.lukaswojcik.com\/blog\/wp-content\/uploads\/2026\/07\/lw-x2.jpg","contentUrl":"https:\/\/www.lukaswojcik.com\/blog\/wp-content\/uploads\/2026\/07\/lw-x2.jpg","width":424,"height":636,"caption":"luky"},"logo":{"@id":"https:\/\/www.lukaswojcik.com\/blog\/wp-content\/uploads\/2026\/07\/lw-x2.jpg"},"sameAs":["https:\/\/www.lukaswojcik.com\/blog"]}]}},"_links":{"self":[{"href":"https:\/\/www.lukaswojcik.com\/blog\/wp-json\/wp\/v2\/pages\/13428","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.lukaswojcik.com\/blog\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/www.lukaswojcik.com\/blog\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/www.lukaswojcik.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.lukaswojcik.com\/blog\/wp-json\/wp\/v2\/comments?post=13428"}],"version-history":[{"count":0,"href":"https:\/\/www.lukaswojcik.com\/blog\/wp-json\/wp\/v2\/pages\/13428\/revisions"}],"up":[{"embeddable":true,"href":"https:\/\/www.lukaswojcik.com\/blog\/wp-json\/wp\/v2\/pages\/9284"}],"wp:attachment":[{"href":"https:\/\/www.lukaswojcik.com\/blog\/wp-json\/wp\/v2\/media?parent=13428"}],"wp:term":[{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.lukaswojcik.com\/blog\/wp-json\/wp\/v2\/tags?post=13428"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}