Security Headers Checker

HTTP response headers like Content-Security-Policy and Strict-Transport-Security are one of the cheapest ways to harden a website against XSS, clickjacking, and downgrade attacks — but they're also easy to forget, easy to misconfigure, and hard to eyeball for correctness. The Security Headers Checker parses a pasted block of response headers and grades your security posture on a weighted A+ to F scale, with a plain-English explanation of exactly what's wrong (or right) with each header.

How to use it

1. Capture the response headers for the page you want to check — from your browser's Network tab (right-click a request → Copy → Copy response headers), from curl -sD - -o /dev/null https://example.com, or from any raw HTTP trace.
2. Paste the block into the input box, one header per line in Key: Value format. A leading status line (HTTP/1.1 200 OK) is fine — it's ignored.
3. The grade and breakdown update automatically as you type.

The output has two parts:

• Security Grade — an overall letter grade (A+ through F), a 0–100 score, and a count of how many of the eight graded headers are present.
• Header-by-Header Results — every graded header with its status (Good / Warning / Issue / Missing), its weight in the overall score, the raw value found (if any), and a short note explaining the finding.

How is the grade calculated?

Eight headers are graded, each with its own weight reflecting how much it matters for typical web security:

Header	Weight	What's checked
Content-Security-Policy	25	A baseline default-src/script-src, no wildcard origins, no unjustified unsafe-inline/unsafe-eval, a frame-ancestors directive, valid directive syntax
Strict-Transport-Security	20	max-age of at least one year, includeSubDomains, and preload eligibility
X-Frame-Options	10	DENY or SAMEORIGIN (the deprecated ALLOW-FROM is flagged)
X-Content-Type-Options	10	Set to exactly nosniff
Referrer-Policy	10	A privacy-preserving value like strict-origin-when-cross-origin, not unsafe-url
Permissions-Policy	10	Sensitive features (camera, microphone, geolocation, etc.) explicitly restricted
Cross-Origin-Opener-Policy	8	same-origin for the strongest isolation
Cross-Origin-Embedder-Policy	7	require-corp or credentialless

Each present header gets a 0–100 score based on the severity of its issues (a serious misconfiguration scores much lower than a minor one), and a header that's missing entirely contributes zero to that header's share of the total. The weighted average becomes your overall score, which maps to a letter grade: 95+ is A+, 85+ is A, 75+ is B, 60+ is C, 40+ is D, and anything below is F.

X-Frame-Options is the older clickjacking defense; a modern CSP's frame-ancestors directive supersedes it, which is why the CSP check flags a missing frame-ancestors on its own even when X-Frame-Options is set correctly.

Why isn't my header showing up?

Only the eight headers above are graded. Anything else you paste — Cache-Control, Access-Control-Allow-Origin, Server, custom X-* headers — is simply ignored by the grade; it doesn't help or hurt your score.

Does this fetch my site's headers for me?

No — it's paste-only. It never makes a network request, so it works equally well for a public site, a staging server behind a VPN, or headers you're drafting before deployment.

Is a missing header always a problem?

Not necessarily. A JSON API with no browser-rendered HTML has little use for X-Frame-Options, and an internal tool behind auth may not need a strict Permissions-Policy. Treat a low grade as a checklist to review, not an absolute verdict — context matters.

Privacy

All parsing and grading happens entirely in your browser. The headers you paste are never uploaded, logged, or sent anywhere.