01HTTP response header analyzerRuns in your browser
A security grade with published points, a plain-English note on every header, and the exact lines to add to nginx, Apache, Caddy, Vercel or your _headers file.
Paste, or drop a .har / .txt file on the box. Nothing leaves your browser.
| Content-Security-Policyscript & XSS policy | – / 25 | |
|---|---|---|
| Strict-Transport-SecurityHTTPS only | – / 20 | |
| Frame protectionframe-ancestors / X-Frame-Options | – / 15 | |
| X-Content-Type-Optionsno MIME sniffing | – / 10 | |
| Referrer-PolicyURL leakage | – / 10 | |
| Permissions-Policybrowser features | – / 10 | |
| COOP · CORP · COEPcross-origin isolation | – / 10 | |
| Deductionsleaks & cookie flags, at most −10 | – |
Browsers do not let one site read another site's response headers, so live checks run elsewhere: this opens WebTraceCheck's security headers check in a new tab, with your URL filled in.
Score details, Content-Security-Policy findings, every header explained, and copy-ready fixes.
curl -sI https://your-site.example, from DevTools (Network → the document request → Response Headers → Raw), or by saving a HAR file.Generators and checkers for each header the analyzer scores.
Build a policy directive by directive, hash inline scripts, export for any server.
Content-Security-PolicyFind unsafe-inline, wildcards, missing object-src and strict-dynamic surprises.
script-src 'unsafe-inline'Pick values for HSTS, framing, referrer and isolation headers; get the config.
Strict-Transport-SecurityAllow or block camera, geolocation and 30+ features; convert Feature-Policy.
camera=(), geolocation=(self)Origins, methods and credentials to response headers, with a preflight simulator.
Access-Control-Allow-OriginPresets for hashed assets, HTML, APIs and private data; explain any header.
max-age=31536000, immutableBuild and parse cookies; SameSite, Partitioned and __Host- rules checked.
__Host-sid=…; SecureEvery tool runs in this tab. What you paste is never uploaded.
connect-src 'self'Checks a live URL's security headers for you: CSP, HSTS, X-Frame-Options and frame-ancestors, Referrer-Policy, Permissions-Policy, COOP, CORP, Access-Control-Allow-Origin and cookie attributes. Also free: a redirect chain checker, website audit and DNS lookup.
Its disposable cloud browser (Chrome, Firefox, Brave, Edge or Chromium on an isolated Linux desktop, deleted after each session) is handy for opening a site you would rather not load on your own machine.
Try WebTraceCheckTesting sign-up, login and password-reset flows on a staging site needs fresh accounts. CleanTempMail gives you an instant temporary inbox with no sign-up, a random or custom address on hundreds of domains, and deletes the mail automatically after 3 days.
For automated tests there is a Temp Mail API, paid once per request quota with no subscription.
Get a temporary inboxA web page cannot read the response headers of another site: browsers block that for security (CORS). So this analyzer works on headers you capture yourself, which also covers staging servers, intranets and responses behind a login. Use curl -sI https://example.com, copy them from your browser's DevTools, or save a HAR file. For a live check, the box above opens WebTraceCheck's security headers check in a new tab.
Each check has fixed points: Content-Security-Policy 25, Strict-Transport-Security 20, frame protection 15, X-Content-Type-Options 10, Referrer-Policy 10, Permissions-Policy 10 and cross-origin isolation (COOP, CORP, COEP) 10. Up to 10 points are deducted for version leaks and cookies without Secure or HttpOnly. A+ needs 95 or more with no deductions; A is 85, B 70, C 55, D 40, E 25, and anything lower is F.
Raw headers with or without a status line, curl -I, -i and -v output (including redirect chains from -L, where each response gets its own tab), DevTools copies with names and values on separate lines, HAR files or fragments, and JSON objects of headers. Folded lines, repeated headers, mixed case and multiple Set-Cookie lines are handled.
No. Parsing, grading and snippet generation run in JavaScript in this tab. The site's own Content-Security-Policy only allows connections back to this site and to Cloudflare's cookie-free page-view counter, which never receives what you paste.
No. Headers are one defensive layer: they limit the damage of bugs such as cross-site scripting or clickjacking, but they do not fix vulnerable code, weak authentication or outdated software. Treat the grade as a checklist for that layer.