HTTP Security Header Checker
Audit pasted response headers locally for common browser security protections
Examples
Check a site that ships strong headers
url: https://example.comStrict-Transport-Security: max-age=31536000
Content-Security-Policy: default-src 'self'
X-Content-Type-Options: nosniff
Grade: AHSTS, CSP, and nosniff are present, so the major browser defenses are active and the site scores well.
Detect a missing CSP
url: https://insecure.exampleMissing: Content-Security-Policy
Missing: Strict-Transport-Security
Grade: D — add CSP and enable HSTSAbsent headers are flagged so you know exactly which defenses to add to your server or CDN response.
About this tool
HTTP security headers activate browser defenses that ordinary application code cannot replace. They can pin future requests to HTTPS, restrict script and resource loading, prevent unauthorized framing, disable MIME sniffing, limit referrer data and powerful browser features, and isolate pages from untrusted cross-origin windows.
This checker audits seven common controls from a raw response-header block: Strict-Transport-Security, Content-Security-Policy, X-Frame-Options or CSP frame-ancestors, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, and Cross-Origin-Opener-Policy. It distinguishes a missing header from a weak value, such as a short HSTS max-age, CSP unsafe-inline or unsafe-eval, an ineffective X-Content-Type-Options value, or a non-isolating COOP policy.
The tool does not fetch your site. Parsing and auditing happen entirely in the browser, so you can safely paste headers copied from developer tools, curl, a private staging environment, or an internal application. Treat the findings as a focused baseline and test policy changes against your application before deploying them broadly.
How to use
Paste response headers
Copy a raw HTTP response-header block from developer tools or curl and paste one Name: Value pair per line.
Review the summary
Read the live issue and critical counts, then inspect every present, missing, or weak finding.
Fix and recheck
Update your server configuration, copy the new response headers, and paste them again until the intended protections show as present.
Use cases
Auditing your own site before launch
Confirm HSTS, CSP, frame-ancestors, and nosniff are sent on every response so browsers enforce your defenses.
Comparing staging vs. production headers
Spot a regression where a proxy stripped a security header between environments.
Pen-test reconnaissance
Quickly see which browser protections a target has enabled or left default during an authorized assessment.
Audited protections
| Header | Protection |
|---|---|
| Strict-Transport-Security | HTTPS enforcement and downgrade resistance |
| Content-Security-Policy | Resource allowlisting and script-injection mitigation |
| X-Frame-Options / frame-ancestors | Clickjacking protection |
| X-Content-Type-Options | MIME sniffing prevention |
| Referrer-Policy | Outbound referrer-data control |
| Permissions-Policy | Browser capability restrictions |
| Cross-Origin-Opener-Policy | Cross-origin window isolation |
The checker audits pasted text locally and makes no network requests.
Common mistakes
Mistake:Treating a green grade as a complete security program.
Fix:Headers harden the browser side; they do not replace authentication, input validation, or dependency patching. A good grade is one layer, not the whole picture.
Mistake:Adding a Content-Security-Policy that breaks the site.
Fix:Start in Report-Only mode, collect violations, then tighten. A mis-set CSP can block your own scripts and styles.
Mistake:Forgetting that the checker only sees response headers.
Fix:It reports what the server sends, not what the app does. A missing header means the defense isn't declared, not necessarily that it's enforced elsewhere.
Frequently asked questions
Related guides
Security Headers Checker — Grade and Fix HTTP Response Headers
Fetch live headers, get an A–F grade, and read MDN-linked fixes for HSTS, CSP, clickjacking, and more.
Content-Security-Policy: Build It Right, Then Audit It
A practical guide to authoring a strong Content-Security-Policy and auditing one you already ship. How default-src, unsafe-inline, wildcards and frame-ancestors affect your real XSS protection.
HTTP Security Headers Explained: HSTS, CSP, and the Rest
A practical guide to response security headers. What HSTS, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy and Permissions-Policy actually do, and the weak values to avoid.
References & standards
Related tools
AES Encryption
Encrypt and decrypt text with AES-GCM and a passphrase, fully in your browser. Uses PBKDF2 key derivation and the Web Crypto API — your data and keys never leave your device.
Basic Auth Generator
Generate an HTTP Basic Authentication header from a username and password. Produces the Authorization header and ready-to-use curl and fetch snippets. Runs fully client-side.
Bcrypt Generator & Verifier
Hash passwords with bcrypt and verify hashes — choose your cost factor (rounds 4–15), get a secure hash instantly, and check whether a password matches a hash. Runs entirely in your browser.
BIP39 Mnemonic Generator
Generate and validate BIP39 seed phrases locally for testing
Checksum Calculator
Compute file checksums (SHA-1, SHA-256, SHA-384, SHA-512) in your browser with the Web Crypto API
Client-Side File Encryptor
Encrypt any file with AES-256-GCM and PBKDF2 directly in your browser — no uploads, no accounts, wrong passwords fail loudly.