Security Headers Analyzer
Check HSTS, CSP, X-Frame-Options and more — 100% private, in your browser
Paste response headers
Run curl -sI https://your-site.com in your terminal, copy the output, and paste it here. Headers never leave your browser.
About the Security Headers
HTTP security headers are the first line of defense against common web attacks: XSS via Content-Security-Policy, clickjacking via X-Frame-Options, protocol downgrade via HSTS, and MIME-type sniffing via X-Content-Type-Options. Every production site should send all six critical headers.
This analyzer fetches the URL from your browser and checks which security headers are present and correctly configured. You get an A-F grade with specific fix recommendations for each missing or misconfigured header. All checks run client-side — the URL is never sent to a third-party scanner.
How to use
- Enter the URL you want to check.
- Click Analyze — the request runs from your browser.
- Review the A-F grade and individual header statuses.
- Apply the fix recommendations for each missing header.
Frequently Asked Questions
What is a good security headers score? ▾
A (90+) means all critical headers are present and correctly configured. B (75+) is acceptable for most sites. Anything below C should be fixed — you are missing protections against XSS, clickjacking, or protocol downgrade attacks.
Why can this tool not read headers from some sites? ▾
The browser only exposes response headers to JavaScript when the server sends Access-Control-Allow-Origin for the requesting origin. Sites that do not send CORS headers cannot be inspected from a browser — use curl -I from a terminal for those.
Which headers are most important? ▾
Content-Security-Policy and Strict-Transport-Security are the two highest-impact headers. CSP prevents XSS and data injection; HSTS prevents protocol downgrade and cookie hijacking over HTTP.
Is this tool free to use? ▾
Yes! This tool is 100% free. No signup, no credit card, no limits. It's part of Formatho's privacy-first developer toolkit.
Is my data safe? Does this tool send data to a server? ▾
Absolutely. This tool runs entirely in your browser. Your data never leaves your device. Zero server-side processing, zero tracking.