← All tools

HTTP Security Headers Analyzer

Fetches a URL and grades the response security headers: Strict-Transport-Security, Content-Security-Policy, X-Frame-Options, Referrer-Policy, Permissions-Policy and X-Content-Type-Options, with an A-F score, the same headers browsers actually enforce.

📖 Guide: HTTP security headers explained

Last updated: September 9, 2026

How to use this tool

1. Enter a URL and click Analyze.
2. Review the grade for each header — a header shown missing or weak is a concrete, actionable fix, usually a one-line addition to your web server or application config.
3. Start with Content-Security-Policy and Strict-Transport-Security; they cover the most common attack classes (XSS and protocol downgrade).
4. Re-run after each change to confirm the new header is actually being sent.

Use it during development, before a launch, or periodically on a production site — these headers are read by every visitor's browser, so a missing one is a gap in real, live protection, not a theoretical risk. It's also a quick way to sanity-check a CDN or reverse proxy in front of your app, since either can silently strip or override a header your application code is actually sending correctly.