HTTP Security Headers Checker
Paste raw response headers and check them against HSTS, CSP, X-Frame-Options, and more
Get real headers with curl -I https://example.com, or copy them from your browser's Network tab (click a request → Headers → Response Headers).
About this tool
The HTTP Security Headers Checker analyzes a pasted block of raw HTTP response headers against the standard set of browser-enforced security headers — HSTS, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, and a few others — and produces a scored report explaining what each one does, whether it's present, and whether its value looks correctly configured. Unlike tools that require pointing at a live URL (which raises its own CORS and privacy considerations for a browser-only tool), this one works entirely from headers you paste in directly — copied from curl -I, from your browser's DevTools Network tab, or from your own server's config as a pre-deployment check. Each check explains not just whether a header is present, but why its absence or misconfiguration actually matters — the goal is understanding the risk, not just a pass/fail checklist.
When to use it
- →Auditing your own site's security headers before or after a deployment
- →Understanding what a specific security header actually protects against
- →Reviewing headers copied from a security scan report or a colleague's curl -I output
- →Checking a CSP or HSTS configuration for the specific misconfigurations most commonly missed
Tips
- ◆Get real headers with curl -I https://example.com, or from your browser's Network tab (click a request → Headers → Response Headers) — paste them exactly as shown.
- ◆A header being 'present' isn't the same as being correctly configured — check the specific note under each header, since a few (like CSP with unsafe-inline, or HSTS with a short max-age) are flagged even when technically present.
- ◆The critical-severity headers (HSTS, CSP) matter most — a page missing those has meaningfully weaker protection than one missing only the info-severity headers.
Frequently asked questions
Why can't I just paste a URL instead of headers?
Fetching a live URL's headers from browser JavaScript runs into CORS restrictions for cross-origin requests, and would mean this tool making a network request on your behalf — which doesn't fit a 100% client-side, no-server-calls tool. Pasting headers you've already retrieved (via curl, DevTools, or your own server logs) sidesteps both issues entirely.
Is a 100 score the same as 'fully secure'?
No — this checks a specific, well-known set of security-relevant response headers, which is one meaningful but partial slice of a site's overall security posture. A perfect score here says nothing about the application's own code, authentication, or server configuration beyond these particular headers.
Why is Content-Security-Policy marked critical when my site works fine without it?
A site can function completely normally without CSP — the header doesn't change what the site does for legitimate users. What it does is restrict what an attacker's injected script could do if an XSS vulnerability were ever found elsewhere in the application. Its absence isn't visible in normal use precisely because its entire purpose only matters in an attack scenario.