Security Header Analyzer
Grade the security headers of any page. Enter a URL and our server fetches its response headers, or paste headers from your browser’s developer tools to analyse them locally. The analyzer checks Strict-Transport-Security (age, subdomains, preload), Content-Security-Policy (with a CSP score), X-Content-Type-Options, clickjacking protection, Referrer-Policy, Permissions-Policy, Cross-Origin-Opener-Policy and Cross-Origin-Resource-Policy, and warns when Server or X-Powered-By headers reveal software versions.
- Encrypted connection
- No sign-up
- Free to use
How to use Security Header Analyzer
- Enter a URL or paste response headers.
- Click Analyze headers.
- Fix the red items first.
- Run the check again after deploying.
Security Header Analyzer features
Grade and score
Weighted towards HSTS and CSP.
Paste mode
For staging or internal sites.
Version leaks
Server, X-Powered-By, X-AspNet-Version.
All headers
Full list for reference.
Explained findings
What and why.
Deprecated headers
X-XSS-Protection advice.
When to use Security Header Analyzer
- Release checklists.
- Penetration test preparation.
- Hosting migrations.
- Comparing CDN configurations.
Security Header Analyzer FAQ
Which headers matter most?
HSTS and a strict Content-Security-Policy give the biggest protection, followed by X-Content-Type-Options and frame-ancestors.
Is X-XSS-Protection still needed?
No – it is deprecated. Send 0 or omit it and rely on CSP.
Why hide Server versions?
Version numbers help attackers find known vulnerabilities quickly.
How do I add these headers?
In your web server, CDN or application. The security headers generator writes the configuration.
Which header should I add first?
Strict-Transport-Security and X-Content-Type-Options are simple and low-risk. Content-Security-Policy gives the most protection but needs careful testing.
What does X-Content-Type-Options do?
With the value nosniff it stops browsers from guessing a file’s type, which prevents some attacks where uploaded files are run as scripts.
Is X-Frame-Options still needed?
Content-Security-Policy frame-ancestors replaces it in modern browsers, but sending both is a common, harmless way to protect older ones against clickjacking.
Can headers be set in a CMS?
Many hosts and CMS plugins let you add headers; otherwise set them in the web server configuration, such as .htaccess on Apache or the server block on nginx.
Defence in depth
Security headers do not fix vulnerabilities in your code, but they limit what an attacker can do with one – for example, a strict CSP stops most injected scripts from running.
Security headers tell browsers how to protect your visitors. The analyzer grades Strict-Transport-Security, Content-Security-Policy, X-Content-Type-Options, Referrer-Policy, Permissions-Policy and the frame protections, and explains what each missing or weak value means.
Pasting headers from your browser’s developer tools analyses them locally, which also works for pages behind a login. For a URL, our server fetches the response headers once and nothing is stored.
Add headers one at a time and test the site after each – a strict Content-Security-Policy in particular can block scripts you rely on. Only analyse sites you own or are allowed to test.
A practical rollout order: start with Strict-Transport-Security (once all subdomains use HTTPS), X-Content-Type-Options: nosniff and a Referrer-Policy such as strict-origin-when-cross-origin, which rarely break anything. Add a Permissions-Policy that switches off browser features you do not use, such as camera or geolocation.
Content-Security-Policy comes last because it needs the most testing: deploy it in report-only mode first, collect violation reports, adjust the policy and only then enforce it. Re-run the analyzer after each change to confirm the headers are actually sent on every page, including error pages and pages served from a CDN.
Headers set by a CDN or proxy can differ from those set by your server, so analyse the public URL that visitors actually use.