Contact

Tools  /  Security  /  Security Headers Checker

SECURITY

Security Headers Checker

Paste HTTP response headers for a letter-graded security audit -- 12 headers checked for both presence and configuration quality, with a full CSP directive breakdown.

More Security tools

JWT Decoder & Generator HMAC Generator Hash Identifier Random Token Generator UUID Validator OAuth URL Builder

What this tool does

Grades a pasted block of HTTP response headers the way a real security headers audit does -- not just "is this header present" but "is it actually configured well" -- across 12 headers, with a letter grade (A+ through F) and a full breakdown of exactly what earned or cost points.

Why presence alone isn't enough

A Strict-Transport-Security header with max-age=60 technically exists but provides almost no protection -- a real check needs the actual value, not just whether the header name appears. Every header here is checked for both: whether it's present, and whether its value is actually doing its job.

Headers checked

Content-Security-Policy (parsed directive-by-directive, flagging unsafe-inline, unsafe-eval and wildcard sources), Strict-Transport-Security (max-age threshold, includeSubDomains, preload), X-Frame-Options (DENY/SAMEORIGIN vs. the deprecated ALLOW-FROM), X-Content-Type-Options (nosniff), Referrer-Policy (flagging the overly permissive unsafe-url), Permissions-Policy, Cross-Origin-Opener-Policy, Cross-Origin-Embedder-Policy, Cross-Origin-Resource-Policy, plus information-disclosure headers (Server, X-Powered-By, X-AspNet-Version) that should generally be absent or generic rather than announcing exact software versions to an attacker.

CSP directive breakdown

Content-Security-Policy is parsed into its individual directives (script-src, style-src, object-src, frame-ancestors, etc.) and each is shown with its sources, flagging 'unsafe-inline' and 'unsafe-eval' (both significantly weaken CSP's XSS protection), a bare * wildcard, and a missing object-src 'none' or base-uri.

The grading scale

Points are awarded per header based on both presence and configuration quality, then mapped to a letter grade -- the exact point breakdown is shown for every header checked, not hidden behind an opaque score, so you can see precisely what to fix to improve it.

What this tool can't do

It only evaluates headers you paste in -- it cannot fetch headers from a live URL itself, because a browser's CORS restrictions block JavaScript from reading most response headers cross-origin (real hosted checkers get around this with a server making the request, which this site deliberately doesn't run). Grab the headers with your browser's dev tools Network tab, or curl -sI https://example.com, and paste them here.

Privacy

Everything is parsed and graded entirely in your browser. Nothing is uploaded.

FAQ

Frequently asked questions

Why does this need pasted headers instead of just a URL?
Browser JavaScript is blocked by CORS from reading most response headers on a cross-origin request -- real hosted security-header checkers work around this with their own server making the request. This tool has no server component, so paste the headers instead: your browser's Network tab, or `curl -sI https://example.com`, both show them directly.
Why is a header flagged even though it's present?
Presence alone isn't enough -- a weak value (like Strict-Transport-Security with a tiny max-age, or Referrer-Policy set to unsafe-url) technically satisfies "the header exists" while providing little real protection. Every header is checked for configuration quality, not just presence.
What does the CSP breakdown actually flag?
'unsafe-inline' and 'unsafe-eval' (both significantly weaken CSP's core XSS protection), a bare * wildcard source, and a missing object-src 'none' or base-uri directive -- the most common ways a Content-Security-Policy ends up providing far less protection than it looks like it does.
How is the letter grade calculated?
Each of the 12 checked headers contributes points based on both whether it's present and how well it's configured, shown individually for every header -- the total maps to a letter grade from A+ down to F, with the full point breakdown visible rather than hidden behind a single opaque number.
Why are Server and X-Powered-By flagged as a problem?
They're not a vulnerability by themselves, but announcing exact software and version numbers (like "Apache/2.4.41" or "PHP/7.4.3") hands an attacker a head start on finding version-specific known exploits -- best practice is to suppress or genericize them.
Is X-XSS-Protection still worth setting?
It's deprecated -- modern browsers removed the legacy XSS auditor it controlled, and Chrome actively ignores the header now. It's shown as informational only, with neither a bonus for having it nor a penalty for leaving it out.
Does a good grade here mean a site is fully secure?
No -- this only evaluates HTTP response headers, one layer of defense among many. A site can have a perfect header grade and still have an entirely separate vulnerability (SQL injection, broken authentication, etc.) that headers alone never touch.
Is anything I paste sent anywhere?
No. Parsing and grading happen entirely in your browser -- this tool has no server component at all.
Theme Accent