BYTETOOLS

Security Header Analyzer

Paste HTTP response headers and get a per-header pass, warn or fail verdict plus an overall grade covering HSTS, CSP, cookies and information leaks.

What is the Security Header Analyzer?

A security header analyzer checks the HTTP response headers a site sends — Strict-Transport-Security, Content-Security-Policy, X-Content-Type-Options and others — and reports which are missing, weak or misconfigured.

  • Per-header pass, warn or fail verdicts with a score out of a fixed maximum
  • Detailed CSP analysis: default-src, unsafe-inline, unsafe-eval, wildcards and frame-ancestors
  • HSTS checks for max-age length, includeSubDomains and preload eligibility
  • Set-Cookie inspection for Secure, HttpOnly and SameSite flags
  • Flags version-revealing Server and X-Powered-By headers
  • Works entirely offline on pasted text, including internal and staging sites

How to use the Security Header Analyzer

  1. 1

    Open DevTools, go to the Network tab, click the main document request and copy the Response Headers block.

  2. 2

    Paste the headers into the box, or press Load sample headers to see an example report.

  3. 3

    Click Analyse headers.

  4. 4

    Work through the per-header cards — each shows the value found, a score and specific advice.

  5. 5

    Check the information disclosure and cookie flag panels, then copy the full report if you need to share it.

About the Security Header Analyzer

Copy the response headers from your browser's Network panel, paste them here, and get a graded report. The analyzer checks Strict-Transport-Security for max-age length and the includeSubDomains and preload directives, and picks apart your Content-Security-Policy looking for a missing default-src, unsafe-inline, unsafe-eval, wildcard sources and an absent frame-ancestors.

It also checks X-Content-Type-Options for nosniff, validates X-Frame-Options against your CSP frame-ancestors directive, rates your Referrer-Policy and looks for Permissions-Policy. Every Set-Cookie line is inspected for the Secure, HttpOnly and SameSite flags, and Server and X-Powered-By headers that advertise your exact software version are flagged as free reconnaissance for anyone scanning you.

Because it works from pasted text, this tool makes no network requests at all and works on staging environments, internal sites and anything behind a login — places a hosted scanner cannot reach. The letter grade is this tool's own weighting of eight common checks, not an industry certification, so treat it as a prompt to review rather than a pass mark.

Frequently asked questions

How do I check my website's security headers?

Open DevTools, select the Network tab, click your page's document request and copy the response headers. Paste them above and click Analyse headers. You will get a graded breakdown of what is set, what is missing and what is misconfigured.

Which security headers matter most?

Content-Security-Policy and Strict-Transport-Security do the most work: one blocks cross-site scripting, the other prevents downgrade attacks. X-Content-Type-Options: nosniff is a one-line win, and frame-ancestors in your CSP stops clickjacking.

What is a good HSTS max-age value?

31536000 — one year — is standard, with includeSubDomains if every subdomain really is HTTPS-only. Six months is the usual minimum. Add preload only if you are certain, since getting off the browser preload list takes months.

Is unsafe-inline in my CSP really a problem?

Yes. It permits any inline script on the page to run, which is exactly what a cross-site scripting payload needs, so it removes most of the protection CSP was meant to provide. Use nonces or hashes instead, ideally with strict-dynamic.

Does a good grade here mean my site is secure?

No. These headers are defence in depth for browser-based attacks. They say nothing about your authentication, your dependencies, your database or your server configuration. A site can score A+ here and still be trivially exploitable.

Related tools