Security Headers Analyzer
Paste an HTTP response header block to grade HSTS, CSP, clickjacking, MIME-sniffing, referrer, CORS, cookie, and information-disclosure settings. Nothing is sent to a server.
Run curl -sI https://example.com or copy the response headers from DevTools → Network. Redirect chains from curl -sIL are fine: only the last response is graded. HSTS and Secure cookies only apply to HTTPS responses.
- error content-security-policy
No Content-Security-Policy. Any injected script runs with full page privileges.
Fix:
Start from a strict policy and tighten it with the CSP Header Analyzer. - error x-frame-options
Nothing stops other sites from framing this page, which is the precondition for clickjacking.
Fix:
Content-Security-Policy: frame-ancestors 'none' (or X-Frame-Options: DENY) - warning x-content-type-options
Browsers may sniff response bodies and execute a file as a different type than declared, for example an upload served as script.
Fix:
X-Content-Type-Options: nosniff - warning strict-transport-security
max-age is 86400 seconds (1 days). Short windows leave returning visitors exposed between visits.
Fix:
Raise max-age to at least 31536000 once you are sure every subdomain serves HTTPS. - warning referrer-policy
No explicit Referrer-Policy. Browsers default to strict-origin-when-cross-origin today, but older clients send full URLs, including query strings, to other sites.
Fix:
Referrer-Policy: strict-origin-when-cross-origin - warning set-cookie
Cookie "session" has no Secure flag, so it is also sent over plain HTTP.
Fix:
Add ; Secure - warning x-xss-protection
The legacy XSS auditor is removed from modern browsers, and where it existed it introduced its own cross-site leaks.
Fix:
Remove the header, or set X-XSS-Protection: 0. Rely on CSP instead. - warning server
"nginx/1.18.0" discloses an exact software version, which lets scanners match it to known CVEs.
Fix:
Strip the version, or the whole header, at the proxy. - warning x-powered-by
"x-powered-by: Express" advertises your stack to anyone who looks.
Fix:
Disable it (for Next.js, set poweredByHeader: false). - warning set-cookie
Cookie "session" has no HttpOnly flag, so any XSS can read it. Ignore this for cookies your own JavaScript must read.
Fix:
Add ; HttpOnly - warning set-cookie
Cookie "session" has no SameSite attribute. Browsers treat it as Lax, but being explicit avoids differences between clients.
Fix:
Add ; SameSite=Lax (or Strict) - info permissions-policy
No Permissions-Policy. Embedded third-party frames can request camera, microphone, geolocation, and other powerful features unless you deny them.
Fix:
Permissions-Policy: camera=(), microphone=(), geolocation=() - info strict-transport-security
Without includeSubDomains, subdomains can still be reached over plain HTTP and used to set cookies for the parent domain.
- info cross-origin-opener-policy
No COOP. Pages that open or are opened by cross-origin windows keep a handle to each other, which enables XS-Leaks-style attacks.
Fix:
Cross-Origin-Opener-Policy: same-origin - info cross-origin-resource-policy
No CORP or COEP. Other sites can load your resources as sub-resources, which is how Spectre-class side channels read them.
Fix:
Cross-Origin-Resource-Policy: same-origin (for resources not meant to be embedded) - info access-control-allow-origin
Any website can read this response. That is fine for public data and wrong for anything user-specific.
About this tool
Security Headers Analyzer
This tool parses the response headers you paste in and checks them against the settings that decide how browsers treat your site: Strict-Transport-Security, Content-Security-Policy, clickjacking protection (frame-ancestors or X-Frame-Options), X-Content-Type-Options, Referrer-Policy, Permissions-Policy, and the cross-origin isolation family (COOP, COEP, CORP).
It also looks for settings that are actively wrong: CORS responses that allow the null origin or pair a wildcard with credentials, Set-Cookie headers missing Secure, HttpOnly, or SameSite, broken __Host- cookie prefixes, deprecated headers such as X-XSS-Protection and Expect-CT, duplicate headers, and server or framework version disclosure.
Each finding comes with the reasoning and a concrete fix value, and the score is a plain 100-point deduction, so you can see exactly which finding cost you what. Hosted header scanners fetch your URL from their servers; this one only reads what you paste, so it works for staging sites, internal tools, and anything behind a login.
A header check covers delivery, not application logic. A perfect grade means the browser-side guardrails are in place, not that the application is free of injection or authorization bugs.
When to use it
Check a deploy before launch
Run curl -sI against your preview URL, paste the output, and clear every error before promoting to production.
Verify a CDN or proxy change
Paste the headers before and after a CDN, WAF, or reverse-proxy change to confirm nothing was stripped or duplicated.
Audit a login flow
Copy the response headers from the sign-in request in DevTools and check the session cookie's Secure, HttpOnly, and SameSite flags.
Questions
Does this fetch the headers of a URL?
No. It only analyzes headers you paste in. Nothing leaves your browser, which also means it can grade pages that are not publicly reachable.
How do I get a site's response headers?
Run curl -sI https://example.com in a terminal, or open DevTools → Network, reload, select the document request, and copy the response headers. Use curl -sIL to follow redirects; only the last response is graded.
Why is a missing Content-Security-Policy an error?
Without a CSP, any script injected into the page runs with full privileges. A policy limits what injected script can load and where it can send data. Paste your policy into the CSP Header Analyzer to check its directives.
Is X-Frame-Options still needed?
frame-ancestors in CSP replaces it and is more flexible, and browsers prefer it when both are present. This tool accepts either one. Keep X-Frame-Options only if you need to support very old browsers.
Why is X-XSS-Protection flagged?
The browser XSS auditors it controlled have been removed, and in the browsers that had them they created cross-site information leaks. Remove the header or set it to 0, and rely on CSP.
Why do I get cookie warnings on an HTTP response?
Secure only has meaning on HTTPS responses. If you pasted headers from a local HTTP dev server, ignore the Secure and HSTS findings; production serves HTTPS and should pass them.
Related resources