What does the HTTP Header Security Analyzer do?

You paste raw HTTP response headers and it grades your security headers — HSTS, Content-Security-Policy, X-Frame-Options, cookie flags — and flags information disclosure.

Which headers does it check?

Strict-Transport-Security, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, cross-origin policies, Set-Cookie flags, and Server/X-Powered-By disclosure.

How do I get my headers?

Use curl -I https://your-site.com in a terminal, or open browser devtools, go to the Network tab, click a request, and copy the response headers.

No. Analysis runs fully in your browser; nothing is sent anywhere.

Yes, it is free and needs no signup.

HTTP Header Security Analyzer

Paste raw HTTP response headers (from curl -I or browser devtools). The analyzer grades your security headers and cookie flags.

Response headers

Security grade

Header report

Check	Status	Finding

HTTP Header Security Analyzer

Security grade

Header report

Related Tools

Regex Tester

JWT Decoder

Hash Generator

UUID Generator

Unix Timestamp Converter

HTML Formatter