What's the most important security header?

Content-Security-Policy if you have any user-generated content or third-party scripts. Strict-Transport-Security is critical for HTTPS-only sites. X-Frame-Options stops your site being framed in clickjacking attacks. The grade in the tool weights them by impact.

Why is my CSP rated weak?

Common reasons: 'unsafe-inline' in script-src (defeats most of CSP's point), 'unsafe-eval', missing nonces, or a broad allowlist like *.googleapis.com that's too permissive. The tool calls each out.

Is HSTS preload necessary?

Only for high-security sites. Once you opt into preload, your domain is hard-coded into Chrome/Firefox as HTTPS-only — even first-time visitors with no prior HSTS knowledge. Hard to undo.

Is the URL sent anywhere?

The fetch goes to the URL you specify. No third-party logging from this tool.

csp · hsts · x-frame-options · referrer-policy · live

Audit your security headers

Paste response headers from curl -I or DevTools to grade CSP, HSTS, X-Content-Type-Options, frame-ancestors, and more. Runs entirely in your browser.

Security Headers Analyzer

Pass

secure

Warn

tighten

Fail

missing

Input

168 B

4 lines

input · response headers

output · findings

Content-Security-Policyok

Present.

Strict-Transport-Securityok

max-age=31536000

X-Content-Type-Optionsok

nosniff

X-Frame-Options / frame-ancestorsfail

Missing. Set X-Frame-Options: DENY or CSP frame-ancestors 'none'.

Referrer-Policyok

strict-origin-when-cross-origin

Permissions-Policyinfo

Not set. Restrict APIs (camera, geolocation, etc.) with this header.

Quick Start

How to audit security headers

Paste any response's headers; we grade the big six.

01
Grab response headers
Run curl -sI https://example.com or copy from DevTools.
Lookups reference the IANA registries (MIME, HTTP status, TLDs) bundled at build time — no live network calls, no rate limits, no leaked queries.
inputIANAregistryofflinelive
input · queryheaders · IANA
```
HTTP/2 200
strict-transport-security: …
```
loaded · IANA bundlespec · ready
02
Read each finding
Each header is flagged ok, warn, fail, or info with the recommended fix.
Builders emit canonical syntax per the relevant RFC (9110 for HTTP, 5322 for headers, 3986 for URLs) so the output passes spec-compliant parsers.
auditRFC 9110canonicalspec-compliantlive
audit · optionscsp · live
```
[ok] CSP present
```
options applied · livecanonical
03
Address fails first
Missing CSP or HSTS is the highest-impact gap.
Validation flags common pitfalls — uppercase header names, smart quotes inside Content-Type, missing ;charset=utf-8 — before they bite production.
fixvalidationlintpitfallslive
fail · looked upcsp · ready
```
[fail] CSP missing
```
result · livevalidated
04
Copy the report
One-line summary per header for your tracking ticket.
Copy writes the snippet directly into your clipboard; downloads emit the right extension and MIME so curl/httpie pick them up correctly.
exportclipboardMIME-correctblobcurl-ready
ok · copiedready · done
```
Copied report
```
shipped · ready to shipsuccess

Pro tips

Web-spec details that bite later

Idempotency saves retries

POST/PUT/DELETE should be safely retried. Use idempotency keys and return the same response on duplicate requests.

Match RFC 9110 status codes

Don’t invent codes. 422 for validation errors, 409 for conflicts, 429 for rate limits. Standard codes work with off-the-shelf clients.

Set <code>Cache-Control</code> deliberately

Default browser caching is conservative. Use max-age + stale-while-revalidate for hot endpoints.

Validate Open Graph in dev

OG tags break silently. Use a previewer like OG Generator + Facebook’s debugger before launch.

CORS is a server concern

The browser sends the preflight; the server decides. Wildcard origins disable credentials — be explicit.

MIME drives behaviour

Servers must send the right Content-Type. Browsers sniff but the spec says they shouldn’t — be explicit to avoid surprises.

Use Cases

When to audit headers

Launch checklist, compliance, incident response.

Pre-launch

Confirm the production stack ships the right CSP and HSTS. Bundled from IANA registries at build time — no live network call, no rate limit, no leaked queries. The MIME, TLD, and status-code tables are baked in so the tool works offline once loaded.

spec-compliant

Compliance

Tick boxes for OWASP / NIST baselines. Output is canonical per the relevant RFC (9110 for HTTP, 5322 for headers, 3986 for URLs), so spec-compliant parsers accept it as-is. Cross-browser and cross-library behaviour stays consistent.

offline

Post-incident

Triple-check after rolling back a CSP change. Pairs with the curl-to-fetch converter for end-to-end test stubs — copy the curl from DevTools, paste, get an idiomatic fetch() body. Drop into Playwright/Vitest fixtures without manual translation.

IANA-backed

Third-party widgets

Audit headers from embedded vendors. Catches common pitfalls (uppercase header names, smart quotes inside Content-Type, missing ;charset=utf-8) before they bite production. Validation flags rather than auto-corrects so you stay in control.

RFC-aligned

Continuous review

Run on every preview deploy. Validation runs as you type — copy only when the output is shaped correctly. The output drops directly into nginx, Apache, or CDN configs without re-formatting or re-quoting.

production-grade

Onboarding

Show new hires the right baseline. Same input plus same options always produces identical canonical output, so the tool is safe to embed in CI scripts that diff against expected configs.

curl-ready

FAQ

Frequently asked questions

What headers do you grade?

CSP, HSTS, X-Content-Type-Options, X-Frame-Options / frame-ancestors, Referrer-Policy, Permissions-Policy, X-XSS-Protection (legacy), and Server.

Is CSP enough alone?

No — CSP defends mostly against XSS. HSTS, X-Content-Type-Options, frame-ancestors, and Referrer-Policy cover other classes.

Should I keep X-XSS-Protection?

No. It's deprecated and a no-op in modern browsers. A proper CSP replaces it.

What's the right HSTS max-age?

At least 15552000 (180 days). For the preload list, use 63072000 (2 years) with includeSubDomains; preload.

Is anything sent to a server?

No — the audit runs locally in your browser.

Suggest a tool

Something missing?

Tell us what you need. We ship the top requests every two weeks.

47 in queue·8 shipped this month

Request queued. Thanks!