Free · your headers · nothing for sale
Run the header request on an app you run. Send that text here. This server returns findings with stable IDs and, when you name a platform it knows, a snippet for that config. It does not open the URL.
Seven response-header findings. Each one comes back with an id, a severity, a why, a short evidence clip, and either a fix or fix: null.
An empty findings list means those seven were clear in the text you sent. It is not a certificate, and it is not a statement about the rest of the app.
CSP and clickjacking is the note for GLC-CSP-MISSING and GLC-FRAME-MISSING: when each one fires, what clears it, and the snippets for the five platforms. The same note is at csp-and-clickjacking.md.
POST /v1/analyze on this host. The body is JSON, at most 64 KB. headers_raw is required: the status line and the response headers, the kind of text curl -sI prints when you point it at a deployment you run. platform may be caddy, nginx, vercel, netlify, or nextjs. Leave it off, or send any other name, and every finding has fix: null. The Server header is not treated as the platform.
When a fix is attached, it has the snippet, the documentation URL it was taken from, and the date that page was checked. The URL is a citation. This server does not fetch it. Read the snippet before you paste it. A starter policy can break an app that needs a looser one.
config_text and paths_tested are accepted, not checked, and not copied into the JSON. The response says only whether config text was present, and how many paths were listed.
curl -sS https://dontdeployonfriday.com/v1/analyze \
-H 'content-type: application/json' \
--data '{"headers_raw":"HTTP/1.1 200 OK\n","platform":"caddy"}'
That block is missing several of the seven headers, so the JSON lists them. Thirty requests per minute per IP, then 429. A body over 64 KB is 413. GET is 405. Malformed JSON is 400. The response sends Cache-Control: no-store. Evidence clips a checked header line at 180 characters.
The same POST is described for agents at /openapi.json (OpenAPI 3.0). The examples there are this call. This host does not publish an MCP server.
Prefer https://dontdeployonfriday.com. A request to that name on port 80 redirects to HTTPS. The bare IP still answers on port 80 without TLS, so anyone on that path can read the body. Do not POST secrets, cookies, or tokens on either URL. Leave Cookie, Authorization, and Set-Cookie out of the header block. The check does not need them.
An earlier page on this site described a paid worksheet. That worksheet is not for sale, and the file is not on this site. The sample still has a free data-access matrix and one webhook definition you can copy. This server does not read what you write there.