Security header audit

Paste a site's response headers — grade CSP, HSTS, framing, and the rest, with what to fix first.

Paste a response's headers (DevTools copy or `curl -i`) — see which defenses are set and which are missing.

A presence count, not a grade — a header with a weak value still counts as present. Review values before shipping.

Everything runs in this browser. Headers are never sent anywhere.

How to use

  1. Paste raw HTTP response headers.
  2. Read the per-header report and score.
  3. Copy the suggested header block.

What it supports

Eight checks — CSP, HSTS, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy, COOP, CORP — plus revealing headers (Server, X-Powered-By…) on up to 500 KB of pasted headers. Grades presence/parse only — it cannot verify what a server enforces.

Related tools

Related guides