HTTP Security Headers Checker — Grade Your Response
Paste HTTP response headers and instantly see which security headers are missing — HSTS, CSP, X-Frame-Options, nosniff, Referrer-Policy, Permissions-Policy — plus cookie flag and Server version checks.
Last reviewed 2026-10-19. Rates change — verify against the official sources linked below before relying on these figures.
What this is based on
- Checks the six headers with the widest protection coverage, plus Server-version disclosure and Set-Cookie flags (Secure, HttpOnly, SameSite).
- X-Frame-Options passes if either the header is present or CSP frame-ancestors covers it.
- Everything runs locally in your browser — pasted content is never uploaded, logged or stored.
Why paste headers instead of entering a URL?
URL-based scanners see only what a remote fetch returns — often a CDN or WAF response rather than your app's real headers, and frequently blocked by bot protection. Pasting the raw response from your own browser or curl shows exactly what real users receive.
It also keeps private endpoints private: staging URLs and internal dashboards never need to be typed into a third-party scanner.
Start with the cheap wins
X-Content-Type-Options: nosniff, Referrer-Policy: strict-origin-when-cross-origin and X-Frame-Options: DENY are one-line changes with zero risk to functionality. HSTS and a Content-Security-Policy take more care — roll CSP out in Report-Only mode first to see what would break.
Frequently asked questions
- Where do I copy the headers from?
- In Chrome/Firefox: F12 → Network → click a request → Headers → Response headers. Or run curl -sI https://yoursite.com and paste the output.
- Is a missing header an active vulnerability?
- Not by itself — it removes a defense layer. Missing clickjacking or MIME-sniffing protections only matter when combined with another weakness, but they're trivially cheap to add.
- My CDN sets some headers — which ones should my app set?
- Whatever reaches the client last wins. Check the final response the browser sees (what you pasted here) — that is the effective set.
Related calculators
Paste your API's CORS response headers and detect dangerous setups: wildcard origins with credentials, null-origin acceptance, reflected origins and missing Vary: Origin.
Paste code or a git diff and detect leaked credentials — AWS keys, GitHub and Slack tokens, private key blocks, hardcoded API keys and JWTs. Matched values are masked, never displayed.
Paste a JWT and instantly see its header, claims and expiry — decoded entirely in your browser. No upload, no sign-up, nothing leaves your device.