HTTP security headers analyzer
Paste a block of raw HTTP headers (for example copied from your browser's Network tab) to check for the main security headers and understand what each one does. The analysis runs entirely in your browser.
How it works
Many web attacks (clickjacking, XSS, HTTP downgrade) can be greatly mitigated by a few well-configured HTTP response headers. Paste the block of headers returned by your server (visible in the Network tab of any browser's developer tools, on the main document request) to check which ones are present, which are missing, and what each one actually protects against.
Where can I find my site's HTTP headers?
Open your browser's developer tools (F12), go to the "Network" tab, reload the page, click the main HTML document request, then copy the "Response Headers" section. Paste that text as is into the field above.
Should all these headers be enabled on every site?
Most public sites benefit from enabling Strict-Transport-Security, X-Content-Type-Options and a well-suited Content-Security-Policy. Referrer-Policy and Permissions-Policy depend more on context (sensitive data in the URL, need for camera/microphone access). X-XSS-Protection is obsolete and its absence is normal on a modern, well-configured site.
Privacy: the analysis runs entirely in your browser — the headers you paste are never sent to a server.