Security Headers Analyzer
Check for missing common security response headers.
Security Headers Analyzer checks a pasted HTTP response for six widely recommended browser security headers—Content-Security-Policy, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy—entirely in your browser. It is a fast heuristic sanity check, not a full security audit.
How it works
The pasted header block is parsed into a case-insensitive name/value map, skipping an optional leading status line. Each of the six checked header names is looked up in that map; if found, its raw value is shown, and if missing, it is flagged so you know what to add.
Benefits
- Checks six commonly recommended security headers at once
- Case-insensitive header name matching, matching real HTTP semantics
- Fully client-side—no live requests are made to any URL
- Clear present/missing summary you can copy or download
Use cases
- Quickly audit a staging or production response for missing headers
- Compare header coverage before and after a hardening change
- Teach a team what CSP, HSTS, and related headers are for
- Paste headers from a bug report to check hardening status offline
Best practices
- Treat a 'present' result as a starting point—also review the actual policy value for correctness
- Start CSP rollout in report-only mode before enforcing it strictly
- Set HSTS with a long max-age and includeSubDomains once HTTPS is fully verified
- Re-run this check after any reverse proxy, CDN, or framework configuration change
Common mistakes
- Assuming a present header is automatically well-configured
- Forgetting that this tool does not fetch headers itself—you must paste them
- Adding a Permissions-Policy or CSP so strict it breaks legitimate functionality without testing
- Overlooking that some frameworks set headers only on certain routes or status codes
Privacy
Analysis runs entirely in your browser on the text you paste—no network request is made to check any URL and headers are not sent to ToolHub. Because pasted headers may reveal infrastructure details, on-device history requires explicit opt-in.
Frequently asked questions
- Which headers does Security Headers Analyzer check?
- It checks for Content-Security-Policy, Strict-Transport-Security (HSTS), X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy—six widely recommended browser security headers.
- Does it validate that header values are correctly configured?
- No. This is a heuristic presence check only—it reports whether each header exists and shows its raw value, but does not evaluate whether the policy content is strict, complete, or free of mistakes.
- Where do I get the headers to paste in?
- Use your browser's DevTools Network tab, curl -I, or any HTTP client to fetch response headers from a live URL, then paste the raw header block here for analysis.
- Does this tool make a network request to check my site?
- No. You must paste the headers yourself. This keeps the tool fully client-side and avoids exposing internal or staging URLs to a third-party server.
- Is a missing header always a security problem?
- Not necessarily for every application, but each of the six checked headers addresses a well-known browser attack class. Review each missing header against your application's threat model before adding it.
- Are header names matched case-sensitively?
- No. HTTP header names are case-insensitive per spec, so this tool matches them case-insensitively regardless of how they were capitalized in the pasted response.
Related tools
HTTP Headers Parser
security
Parse raw HTTP headers into a structured list.
- http
- headers
- parser
- debugging
JWT Decoder
security
Inspect JWT header and payload locally—no signature verify.
- jwt
- token
- decode
- security
Password Strength Checker
security
Local entropy and checklist-based password strength check.
- password
- security
- strength
- entropy
PEM Decoder
security
Inspect PEM structure and Base64 body locally.
- pem
- certificate
- csr
- x509
Unsigned JWT Builder
security
Build unsigned JWTs for learning—never for production.
- jwt
- security
- education
- alg-none
Caesar Cipher
security
Adjustable-shift Caesar cipher, encode and decode.
- caesar
- cipher
- encode
- decode