HTTP Header Analyzer & Security Check
Paste the response headers from curl -I or your browser dev tools to check HSTS, CSP, X-Content-Type-Options, Referrer-Policy, cookie attributes, and CORS. You get a list of what is missing or weak, plus recommended values. Everything is analyzed in your browser, and the headers you paste are never sent to a server. To build the command that fetches them, see the cURL Converter.
🔒 Runs in your browser · Your data is never sent to a server
The status line (such as HTTP/1.1 200 OK) is optional. Set-Cookie values are not shown in the results (all other headers are shown in full).
Notes
- The analysis only looks at the headers you paste. There is no fetch-by-URL option, because browsers cannot read other sites’ headers because of CORS. Get them with curl -I or the Network tab of your browser dev tools.
- The recommended values are a general starting point. Content-Security-Policy in particular can break a page unless it matches the external resources the site loads, so try Content-Security-Policy-Report-Only first.
- Only set Strict-Transport-Security on sites served over HTTPS. Adding includeSubDomains requires HTTPS on every subdomain.
- Results are general guidance and do not guarantee that a site is secure.
Glossary
HSTS (HTTP Strict Transport Security)
A header that tells the browser to connect to a site only over HTTPS for a set period after the first visit, preventing downgrade attacks to HTTP.
CSP (Content Security Policy)
A header that declares which sources scripts, styles, and images may load from. Even if an XSS bug exists, it can stop an attacker’s script from running.
Clickjacking
An attack that overlays your site as a transparent iframe on a malicious page so users click something unintended. Prevented with X-Frame-Options or CSP frame-ancestors.
SameSite attribute
A cookie attribute that controls whether the cookie is sent on cross-site requests. Lax or Strict helps prevent CSRF (cross-site request forgery).
FAQ
Can I enter a URL and have the headers fetched automatically?
No. Browser JavaScript cannot read another site’s response headers because of CORS, so fetching them would need a server in the middle. This tool makes no requests and analyzes the headers you paste in your browser. Copy them from curl -I https://example.com or the Network tab of your dev tools.
If everything is marked good, is the site secure?
No. The tool only checks for the main security headers and clearly weak values. It cannot detect application vulnerabilities such as SQL injection or broken authentication. Use it as a checklist for configuration gaps, not as proof of security.
Can I deploy the recommended Content-Security-Policy as is?
It is a starting point built around default-src 'self'. A site that loads external scripts, fonts, images, or analytics tags may break if you apply it unchanged. Try Content-Security-Policy-Report-Only first, review the violations, add the sources you need, and then enforce it.
Why is X-Frame-Options marked good when it is missing?
When CSP has a frame-ancestors directive, it already restricts framing, and modern browsers prefer it over X-Frame-Options. If you also need to support very old browsers, set both.
Why are cookie values not shown in the results?
To keep secrets such as session IDs off the screen and out of copied output, only the cookie name and its Secure, HttpOnly, and SameSite attributes are checked. The analysis also happens entirely in your browser, so nothing you paste is uploaded.
Share this page