Security Headers Checker
Paste a site's HTTP response headers and get a weighted A+ to F security grade, plus a header-by-header breakdown of what's missing, misconfigured, or well-configured (CSP, HSTS, X-Frame-Options, and more) — all checked in your browser.
Input
Output
Security Grade
| Metric | Value |
|---|---|
| No data yet | |
Header-by-Header Results
| Header | Status | Weight | Value | Notes |
|---|---|---|---|---|
| No data yet | ||||
More ways to use this tool
REST API
curl -X POST https://api.iotools.cloud/v1/tool/security-headers-checker \
-H "Authorization: Bearer YOUR_API_KEY" \
-H "Content-Type: application/json" \
-d '{
"headersInput": "Content-Security-Policy: default-src 'self'; scr…"
}'Swap in your own key from your account. The tool's fields are the body — no wrapper.
Ask an AI agent
Use the IOTools `security-headers-checker` tool (Security Headers Checker) on this input:
YOUR_INPUT_HEREPaste this at any agent connected to the IOTools MCP server, then add your input.
Embed widget
<iframe
src="https://iotools.cloud/embed/security-headers-checker/"
width="100%" height="520" frameborder="0" scrolling="no" loading="lazy"
title="Security Headers Checker — iotools.cloud"
sandbox="allow-scripts allow-forms allow-same-origin allow-downloads allow-popups allow-popups-to-escape-sandbox"
allow="clipboard-write"
style="width:100%;border:1px solid #e5e7eb;border-radius:12px;overflow:hidden"></iframe>
<script src="https://iotools.cloud/embed.js" async></script>Drop this into your own page — free, no key required, just a link back.
| Cost per API/MCP call | From 5 credits |
|---|---|
| Need more credits? | View pricing |
Also available with
Guides
HTTP response headers like Content-Security-Policy and Strict-Transport-Security are one of the cheapest ways to harden a website against XSS, clickjacking, and downgrade attacks — but they're also easy to forget, easy to misconfigure, and hard to eyeball for correctness. The Security Headers Checker parses a pasted block of response headers and grades your security posture on a weighted A+ to F scale, with a plain-English explanation of exactly what's wrong (or right) with each header.
How to use it
- Capture the response headers for the page you want to check — from your browser's Network tab (right-click a request → Copy → Copy response headers), from
curl -sD - -o /dev/null https://example.com, or from any raw HTTP trace. - Paste the block into the input box, one header per line in
Key: Valueformat. A leading status line (HTTP/1.1 200 OK) is fine — it's ignored. - The grade and breakdown update automatically as you type.
The output has two parts:
- Security Grade — an overall letter grade (A+ through F), a 0–100 score, and a count of how many of the eight graded headers are present.
- Header-by-Header Results — every graded header with its status (Good / Warning / Issue / Missing), its weight in the overall score, the raw value found (if any), and a short note explaining the finding.
How is the grade calculated?
Eight headers are graded, each with its own weight reflecting how much it matters for typical web security:
| Header | Weight | What's checked |
|---|---|---|
Content-Security-Policy |
25 | A baseline default-src/script-src, no wildcard origins, no unjustified unsafe-inline/unsafe-eval, a frame-ancestors directive, valid directive syntax |
Strict-Transport-Security |
20 | max-age of at least one year, includeSubDomains, and preload eligibility |
X-Frame-Options |
10 | DENY or SAMEORIGIN (the deprecated ALLOW-FROM is flagged) |
X-Content-Type-Options |
10 | Set to exactly nosniff |
Referrer-Policy |
10 | A privacy-preserving value like strict-origin-when-cross-origin, not unsafe-url |
Permissions-Policy |
10 | Sensitive features (camera, microphone, geolocation, etc.) explicitly restricted |
Cross-Origin-Opener-Policy |
8 | same-origin for the strongest isolation |
Cross-Origin-Embedder-Policy |
7 | require-corp or credentialless |
Each present header gets a 0–100 score based on the severity of its issues (a serious misconfiguration scores much lower than a minor one), and a header that's missing entirely contributes zero to that header's share of the total. The weighted average becomes your overall score, which maps to a letter grade: 95+ is A+, 85+ is A, 75+ is B, 60+ is C, 40+ is D, and anything below is F.
X-Frame-Options is the older clickjacking defense; a modern CSP's frame-ancestors directive supersedes it, which is why the CSP check flags a missing frame-ancestors on its own even when X-Frame-Options is set correctly.
Why isn't my header showing up?
Only the eight headers above are graded. Anything else you paste — Cache-Control, Access-Control-Allow-Origin, Server, custom X-* headers — is simply ignored by the grade; it doesn't help or hurt your score.
Does this fetch my site's headers for me?
No — it's paste-only. It never makes a network request, so it works equally well for a public site, a staging server behind a VPN, or headers you're drafting before deployment.
Is a missing header always a problem?
Not necessarily. A JSON API with no browser-rendered HTML has little use for X-Frame-Options, and an internal tool behind auth may not need a strict Permissions-Policy. Treat a low grade as a checklist to review, not an absolute verdict — context matters.
Privacy
All parsing and grading happens entirely in your browser. The headers you paste are never uploaded, logged, or sent anywhere.