How to use this security headers analyzer
Choose Live URL and enter a fully qualified address (we prepend https:// when you omit the scheme). Submit to run a server-side fetch with our public-URL safety rules. You will get a numeric score, letter grade, and a checklist explaining each finding. Use Paste or upload when you already have headers from curl -I, a browser, or a proxy—TLS behavior is not verified in that mode, so confirm HTTPS separately or re-run as a live scan. Copy the markdown report to attach to tickets or change requests. For every raw header name and value without scoring, open our HTTP header checker.
Security headers checklist (what we look for)
Transport: live scans expect HTTPS end-to-end. HSTS should use a sensible max-age once you are confident in TLS. CSP reduces XSS impact; iterate with report-only policies before enforcement. X-Content-Type-Options: nosniff avoids MIME sniffing surprises. Frame protection comes from X-Frame-Options or CSP frame-ancestors (avoid * unless you truly need universal embedding). Referrer-Policy and Permissions-Policy tighten data leakage and powerful APIs. Draft CSP with our CSP builder, then validate here after deployment.
Why security headers matter for web apps and APIs
Browsers enforce headers to constrain scripts, framing, and cross-origin interactions. A missing or overly permissive CSP can leave room for XSS payloads; weak frame controls expose clickjacking; missing nosniff increases MIME confusion risk. Headers do not replace secure coding or input validation, but they add defense-in-depth that scales across pages and microservices. Pair this audit with certificate hygiene using our SSL certificate checker and redirect correctness with the redirect chain checker.
Interpreting scores and grades
The score weights presence and quality of common headers; it is not a penetration test or compliance certification. A high grade means the response aligns with common baseline hardening guidance—still review CSP directives for your specific third-party scripts, APIs, and iframes. A low grade usually means missing CSP, missing frame protection, or HTTP-only delivery. Re-scan after each CDN or edge config change because headers are often set at the edge, not only on origin.
Related security and website tools
Explore the full security & encryption tools collection, or jump to adjacent utilities below. For JWT and signing workflows after you lock down transport, see the JWT encoder and HMAC generator.
- Password Strength Meter — Score password entropy, estimate crack time, and get practical hardening tips.
- bcrypt Hash Generator — Generate bcrypt hashes with configurable cost for secure password storage testing.
- AES Encrypt & Decrypt — Encrypt and decrypt text with AES-256 and a passphrase—runs fully in your browser.
- RSA Key Pair Generator — Create 1024–4096 bit RSA public/private key pairs locally for demos and dev workflows.
- CSP Builder — Toggle Content-Security-Policy directives and copy a header value ready for your server.
- JWT Encoder — Build HS256-signed JWTs from custom header and payload for API and auth testing.
- HMAC Generator — Create HMAC-SHA256 or HMAC-SHA512 signatures with a secret for webhook and API verification.
- SSL Certificate Decoder — Paste PEM certificates to read subject, issuer, SANs, and validity windows.
- .htaccess Generator — Assemble common Apache .htaccess rules for redirects, HTTPS, caching, and access control.