Security Headers Checker
Paste HTTP response headers to grade them out of 100, understand what each security header does, and get a copy-paste config to fix the gaps.
Nothing is sent anywhere. Grab the headers with curl -I https://example.com
or copy them from DevTools › Network, then paste them above.
0 / 100 points
Header-by-header explainer
Recommended headers to add
How it works
Paste a block of HTTP response headers and this checker parses them in your browser,
explains what each security header does in plain English, and scores the response out of
100. Eight checks are weighted like this: Content-Security-Policy 25 points,
Strict-Transport-Security 20, X-Content-Type-Options 10, X-Frame-Options (or a CSP
frame-ancestors directive) 10, Referrer-Policy 10, Permissions-Policy 10,
Cross-Origin-Opener-Policy 5, and 10 points for not leaking your stack through
Server version strings or X-Powered-By. Grades are A+ from 95
points, A from 85, B from 70, C from 55, D from 40 and F below that — the same shape as the
familiar scanner grades, but computed locally with the rubric spelled out above rather than
hidden behind a server.
Partial credit is deliberate. A CSP earns 15 points for existing, 5 more for setting
default-src or script-src, and the last 5 only if it avoids
'unsafe-inline' and 'unsafe-eval'. HSTS earns 10 for
existing, 5 for a max-age of at least six months (15768000 seconds), 3 for
includeSubDomains and 2 for preload. Header names are matched
case-insensitively and duplicate headers are joined, so output from curl, DevTools, HTTPie
or a raw socket dump all work. This tool is an explainer and a linter for headers you
already have — it is 100% client-side, makes no requests, and nothing you paste leaves
your device.
Frequently asked questions
How do I check my security headers with this tool?
Grab the response headers yourself and paste them in. Run curl -I https://example.com in a terminal, or open DevTools, pick the document request in the Network tab and copy the response headers. Paste the block into the box and the grade, the header-by-header explainer and the suggested configuration all update as you type. Duplicate headers are merged, header names are matched case-insensitively, and the HTTP status line is ignored, so raw curl, DevTools and HTTPie output all work unchanged.
Which HTTP security headers matter most?
Content-Security-Policy carries the most weight here (25 of 100 points) because it is the strongest defence against cross-site scripting, followed by Strict-Transport-Security at 20 for pinning the site to HTTPS. Then come X-Content-Type-Options: nosniff, X-Frame-Options (or a CSP frame-ancestors directive) against clickjacking, Referrer-Policy and Permissions-Policy at 10 each, Cross-Origin-Opener-Policy at 5, and a final 10 points for not advertising your stack through a versioned Server header or X-Powered-By.
Why does this tool not scan a URL for me?
Because it runs entirely in your browser and makes no network requests at all. A scanner that fetches a URL has to do it from its own servers, which means the hostname you tested is logged somewhere, and it can never reach localhost, a staging box behind a VPN, or a response that needs your login cookie. Pasting headers you already have sidesteps all of that: nothing you paste leaves your device, there is no signup, and private hosts work exactly like public ones.