Paste headers · get security score
· understand every fieldDev Tools
Paste raw HTTP response headers into the HTTP Header Analyser to instantly evaluate
your site's security posture. It checks for HSTS, CSP, X-Frame-Options, and other essential protections.
Try:
HTTP Response / HeadersPaste the full HTTP response or
just the headers block
Paste an HTTP response or click a sample above
Issues
Missing security headers
All headers
Header
Value
Category
Status
Explanation
Advertisement
Input
Paste a full HTTP response (status line + headers) or just the headers block. Use
browser DevTools → Network tab → select a request → copy response headers. Or use
curl -I https://example.com.
Security Score
A–F grade based on presence and quality of key security headers: CSP, HSTS,
X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy. Each header is weighted by
severity.
Issues
Flagged problems with headers that are present but misconfigured — e.g. HSTS
max-age too short, CSP with unsafe-inline, cookie missing HttpOnly,
CORS wildcard on credentialed request.
Missing Headers
Important security headers not found in the response, with an explanation of why each
matters and a recommended value to use.
Header Table
Every header explained in plain English. Filter by category. Click any header name to
copy it. Colour-coded by category — security (red), caching (orange), CORS (cyan), content (green), auth
(purple).
Samples
Five preloaded examples: a well-configured secure response, an insecure one (to see what
bad looks like), a typical API response, a CDN-served static asset, and an HTTP redirect.
Advertisement
How to use
Open the tool and enter your data or select options.
Adjust settings to see real-time updates.
Copy the generated result to your clipboard.
Frequently Asked Questions
What are security headers?
Security headers are HTTP response headers that instruct the browser on how to behave when handling your site's
content, preventing common attacks like XSS or clickjacking.
Why is Content-Security-Policy (CSP) important?
CSP
prevents Cross-Site Scripting (XSS) by explicitly declaring which dynamic resources are allowed to load and
execute.
Does this send my headers to a server?
No,
all analysis is performed locally in your browser using JavaScript.
Did you know?
HTTP Strict Transport Security (HSTS) prevents downgrade attacks by forcing the browser to only connect via
HTTPS.
The X-Powered-By header often leaks the exact version of the framework running your backend, making it easier
for attackers to find known vulnerabilities.
Many modern browsers ignore the older X-XSS-Protection header in favor of a robust CSP.