Check security headers for any website
The HTTP Header Analyzer fetches the response headers a web server returns for any URL and grades them against modern browser security standards. It looks specifically for headers like Strict-Transport-Security (HSTS), Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy, then assigns a letter-grade score based on which protections are present, missing, or misconfigured.
It is used by web developers, DevOps engineers, and security teams who want a quick read on how well a site is defended against clickjacking, MIME sniffing, protocol downgrade, and cross-site scripting attacks. You paste a URL, and instead of reading raw headers by hand in curl or DevTools, you get an itemized checklist explaining what each header does and how to fix the gaps.
When a browser requests a page, the server replies with a status line and a block of response headers before the body. A subset of these headers instructs the browser to enforce security policies. The analyzer parses that block and checks for the key defensive headers: Strict-Transport-Security forces HTTPS and prevents downgrade attacks; Content-Security-Policy restricts which scripts, styles, and frames can load, mitigating XSS; X-Frame-Options (or CSP frame-ancestors) blocks clickjacking; X-Content-Type-Options: nosniff stops MIME-type guessing; Referrer-Policy controls how much URL data leaks to other sites; and Permissions-Policy gates browser features like camera and geolocation.
The score is a weighted tally. Each recommended header that is present and sensibly configured earns points, missing headers lose points, and risky values (for example an HSTS max-age of only a few seconds, or a CSP containing unsafe-inline) are flagged as weak rather than passing. That weighted total maps to a letter grade so you can gauge posture at a glance without memorizing every specification.
Because it reports the literal header values, it also surfaces information-disclosure issues such as a Server or X-Powered-By header advertising exact software versions, which attackers can use to target known vulnerabilities.
It checks the core browser-enforced set: Strict-Transport-Security, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy. It also flags information-leaking headers like Server and X-Powered-By.
The grade is a weighted summary of how many recommended headers are present and correctly configured. Missing headers reduce the score, and weak values such as a short HSTS max-age or a CSP with unsafe-inline are marked as partial rather than full credit.
Headers can be stripped or overridden by a CDN, reverse proxy, or load balancer in front of your origin. The analyzer sees only what the edge server actually returns, so check the layer that terminates the request, not just your application config.
It inspects the response for the exact URL you enter, so you can point it at a deep path. However, it does not submit credentials, so pages requiring authentication will return the login or error response headers instead of the protected page.
No. This tool reads HTTP response headers only. To inspect certificate validity, expiry, and the negotiated cipher, use a dedicated SSL Checker.
Yes, it is completely free with no sign-up. It only submits the URL you enter to fetch that site's public response headers, and it does not store the results or share them.
Use a Security Header Generator to produce ready-to-paste configuration for your web server or framework, then re-run this analyzer to confirm the improved grade.