Security headers analyzer
Paste response headers to see which hardening headers are missing or weak, with the exact header to add.
Check the headers that harden a web application
A handful of HTTP response headers give browsers instructions that block whole classes of attack: cross-site scripting, clickjacking, protocol downgrade and content sniffing. They cost almost nothing to add, yet many applications ship without them, or with values that quietly defeat their purpose, such as a Content-Security-Policy that allows 'unsafe-inline' scripts.
Paste the response headers of any page and the analyser checks the important ones: Content-Security-Policy, Strict-Transport-Security, X-Content-Type-Options, frame protection, Referrer-Policy, Permissions-Policy and Cross-Origin-Opener-Policy, plus information leaks (Server versions and X-Powered-By), cookie attributes and CORS wildcards. Each finding says what is wrong or right and shows the header to add, and a letter grade summarises the result.
Adding the headers in a Java application
- Spring Security sends several by default (X-Content-Type-Options, X-Frame-Options, Cache-Control, HSTS over HTTPS). Configure the rest with
http.headers(h -> h.contentSecurityPolicy(...)). - Tomcat or a reverse proxy can add them for every response; nginx uses
add_header ... always;. - Use the CSP builder on this site to write the Content-Security-Policy, and start in Report-Only mode.
Headers are one layer. Keep dependencies patched, validate input and encode output. Your pasted text is analysed locally and never leaves your browser.
Frequently asked questions
How do I get my site's response headers?
Run curl -I https://your-site.com, or open the browser developer tools, choose the Network tab, click the main document request and copy the response headers. Paste them here.
Does this tool fetch my site?
No. It only analyses the text you paste, in your browser. Nothing is requested from your server and nothing is uploaded.
Which headers matter most?
Content-Security-Policy (against XSS), Strict-Transport-Security (forces HTTPS), X-Content-Type-Options: nosniff, a clickjacking defence (frame-ancestors or X-Frame-Options), Referrer-Policy and Permissions-Policy.
Is the grade official?
No. The score is a simple weighting of the main hardening headers for guidance; it is not a security audit. A site can have perfect headers and still have serious vulnerabilities.