Web Dev Helpers
Security Headers Analyzer
Grade any URL's HTTP security headers - HSTS, CSP, X-Frame-Options and more.
Input
Grade covers the six core headers: Content-Security-Policy, Strict-Transport-Security, X-Frame-Options, Referrer-Policy, Permissions-Policy, X-Content-Type-Options. URL mode uses a server-side fetcher (100/browser/day). Paste mode is fully client-side.
About this tool
Analyze a URL's response headers for common security best practices - HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, COOP, CORP, and Server-header leakage. Produces a letter grade and per-header verdict with actionable suggestions. Two modes: enter a URL (uses a small server-side fetcher on this domain, rate-limited to 15 checks per browser per day) or paste headers directly (fully client-side - use curl -I).
FAQs
How is the grade calculated?
Each check has a weight based on real-world impact (CSP is the heaviest at 25%, HSTS 20%, others less). Missing = 0 credit, weak = 50%, good = 100%. Weighted sum -> percentage -> letter.
Which grade does this show me - the origin or the CDN?
By default the tool sends a normal browser request, so most CDNs let it through and you see the actual origin's headers. Tick 'Trigger WAF' to force a HEAD request with a scanner UA - many WAFs then serve their challenge response with a full hardened header set, and you'll see that grade instead. Use whichever matches what you're trying to audit.
Can I trust the grade?
It's a heuristic - covers the well-established headers. It doesn't audit your actual CSP effectiveness (which requires seeing your JS), TLS config (that's Qualys SSL Labs), or DNS security (DNSSEC).