HTTP Security Headers Analyzer
Analyze HTTP response headers for security configuration issues, missing protections, CSP weaknesses, CORS risks, cookie flags, and more - entirely in your browser.
HTTP Security Headers Analyzer tool
Analysis runs locally in your browser. Your headers are not uploaded or stored.
No analysis yet
Paste HTTP response headers above and click Analyze Headers to see a security-header configuration analysis, score, and recommendations.
How to use the HTTP Security Headers Analyzer
- Copy the response headers for a page, for example from the Network tab in your browser's developer tools or with curl -I.
- Paste them into the analyzer, or try one of the examples.
- Run the analysis and review the score, the checks and the findings, which are grouped by severity.
- Open a finding to see why it matters and what to change, then compare the recommended configuration with your own.
- What you enter
- Raw HTTP response headers, one per line (and optionally the status line). The tool does not fetch a URL for you.
- What you get
- A score and grade, a table of checks, findings with explanations and fixes, a view of the parsed headers, notes on cookies and cross-origin settings, and a suggested header configuration.
Who it is for
- Developers and site owners hardening a website or API
- Engineers reviewing a deployment before launch
- Anyone who has been asked to add security headers and wants to know what each does
Examples
A minimal response
HTTP/1.1 200 OK Content-Type: text/html Server: nginx
Findings for the missing Content-Security-Policy, Strict-Transport-Security, X-Content-Type-Options, Referrer-Policy and a clickjacking control, with a suggested value for each.
A hardened response
Strict-Transport-Security: max-age=31536000; includeSubDomains X-Content-Type-Options: nosniff Referrer-Policy: strict-origin-when-cross-origin
These are recognised as good, and any remaining gaps, such as a missing Permissions-Policy or CSP, are listed.
Key concepts
- What a security header does
- A response header can tell the browser to apply a protection it already supports. The server only has to send the header; the browser enforces it.
- Content-Security-Policy
- Declares where scripts, styles, images and other resources may load from, which limits the damage from injected script. It is powerful and easy to get wrong; the CSP Analyzer examines it in detail.
- Strict-Transport-Security
- Tells the browser to use HTTPS only for a period, so a typed http:// address is upgraded before a request is made.
- X-Content-Type-Options
- The value nosniff stops browsers from guessing a file's type, which blocks a class of attacks where an uploaded file is treated as script.
- Referrer-Policy and Permissions-Policy
- Referrer-Policy controls how much of the page address is sent to other sites. Permissions-Policy turns browser features such as the camera or geolocation on or off for the page and its frames.
- Framing protections
- X-Frame-Options and the CSP frame-ancestors directive control whether other sites can embed your page in a frame, which prevents clickjacking. frame-ancestors is the modern form.
Common use cases
- Review what a production site actually sends after a deployment.
- Check a reverse proxy or CDN has not stripped headers your application sets.
- Prepare a short list of fixes for a hardening ticket.
- Learn what each recommended header is for.
Common mistakes
- Setting headers on the wrong layer
- A header added in the application can be removed or duplicated by a proxy or CDN. Check the response the browser actually receives.
- Copying a long CSP from the internet
- A policy that fits another site often breaks yours. Start in report-only mode and tighten step by step.
- Enabling HSTS preload too early
- Preload is hard to undo. Make sure every subdomain supports HTTPS before opting in.
- Treating the score as a verdict
- A high score means the common headers are present. It does not say the application is secure.
Limitations
- It analyses only the headers you paste. It cannot see page content, cookies set elsewhere, or server configuration that is not in the response.
- It checks against widely recommended practice, which may not suit every site.
- It is not a security audit, penetration test or compliance check.
Results are an aid, not a guarantee. Please read the Disclaimer.
Troubleshooting
- I pasted headers but nothing was recognised
- Make sure each line is in Name: value form and that you copied response headers, not request headers.
- The headers differ from what my code sets
- A proxy, CDN or hosting layer may be adding, changing or removing headers. Compare against the live response.
- A recommended header breaks my site
- Roll it out gradually. For CSP, begin with Content-Security-Policy-Report-Only and review what it would have blocked.
Privacy
The analysis happens in your browser from the headers you paste. The tool does not request your website and the headers are not sent to DevCraftKit. Full details are in the Privacy Policy.
Related guides
Found a security header issue?
If these free developer tools save you time, consider buying me a byte. Your support helps keep DevCraftKit free and growing.
Resources
Related Security Tools
CSP Analyzer
Analyze Content Security Policy headers, detect configuration issues, explain directives and sources, and generate safer CSP recommendations.
Log Sanitizer
Mask secrets, tokens, and PII in logs before you share them.
Secret Scanner
Scan pasted text or files for leaked credentials and keys.
JWT Decoder & Inspector
Decode a JWT, inspect its claims and expiry, and review potential security issues locally.
Explore more developer tools
Browse the full collection, or see everything in Security.
Frequently Asked Questions
- What are HTTP security headers?
- HTTP security headers are response headers a server sends that instruct the browser to enable specific protections - like restricting where scripts can load from (Content-Security-Policy), forcing HTTPS (Strict-Transport-Security), or preventing a page from being framed (X-Frame-Options).
- How do I check HTTP security headers?
- Copy the response headers for a request (from your browser's DevTools Network tab, or a tool like curl -I), paste them into the analyzer above, and click Analyze Headers. You'll get a score, a breakdown by check, and specific findings with recommendations.
- What is a good HTTP security header configuration?
- There's no single universal answer, but a solid baseline includes a tailored Content-Security-Policy, Strict-Transport-Security with a long max-age, X-Content-Type-Options: nosniff, a clickjacking control (X-Frame-Options or CSP frame-ancestors), and a modern Referrer-Policy. The right configuration always depends on what your site actually needs.
- What does Content-Security-Policy do?
- CSP lets a server declare which sources scripts, styles, images, and other resources are allowed to load from. When configured well, it can reduce the impact of certain classes of injection and cross-site scripting (XSS) attacks - it isn't a guarantee against them.
- Why is Strict-Transport-Security important?
- HSTS tells the browser to only ever connect to a site over HTTPS for a set period, which helps close the window for downgrade attacks where a user's connection is redirected to plain HTTP and intercepted.
- What is the difference between CSP and X-Frame-Options?
- Both can prevent clickjacking, but CSP's frame-ancestors directive is the modern replacement - it supports multiple specific origins and more nuanced rules, while X-Frame-Options only supports DENY, SAMEORIGIN, or the largely unsupported ALLOW-FROM. Many sites set both for defense-in-depth on older browsers.
- Is CORS a security header?
- Not exactly a single header - CORS is a browser mechanism controlled by several related headers (Access-Control-Allow-Origin and others) that determine whether a script running on one origin can read a response from another. Misconfigured CORS, especially a wildcard origin combined with credentials, can expose data cross-origin.
- Does this tool scan my website URL?
- No. This analyzer works entirely from headers you paste in - it does not accept a URL, does not fetch or crawl any website, and does not send your headers anywhere. Everything runs locally in your browser. It's a header-configuration analysis, not a complete security audit of a website or application.
Found a bug or an incorrect result in HTTP Security Headers Analyzer?
Report it, or suggest an improvement. Messages go straight to the developer.