Missing a single security header — HSTS, CSP, X-Frame-Options — can leave a site exposed to downgrade attacks, XSS, or clickjacking, and it’s easy to overlook without a systematic check. This tool turns a raw header dump into a clear present/missing checklist.
What Is the Security Headers Analyzer?
Paste the raw response headers from curl -I or your browser’s DevTools Network tab, and get an instant checklist of eight common security headers — which ones are present, their actual values, and why each one matters.
How to Use It
- Open the tool at /tools/security-headers-analyzer.
- Run
curl -I https://yoursite.comor copy response headers from DevTools. - Paste the raw header block into the textarea.
- Review the checklist and score.
Key Features
- Eight header checks: HSTS, CSP, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy, X-XSS-Protection, Cross-Origin-Opener-Policy.
- Plain-English explanation of what each header actually protects against.
- Case-insensitive, order-independent parsing, matching real HTTP semantics.
- Runs entirely client-side — no header data is sent anywhere.
When to Use This Tool
- Auditing a production site’s security posture before or after a deploy.
- Learning what each common security header actually does, with plain-English explanations.
- Quickly checking a fix worked after adding a missing header to your server config.
Try It Now
Open Security Headers Analyzer directly, or press ⌘K and type the tool name from anywhere on the site.
Part of the Security & Crypto collection on WebdevToolbox — free, browser-based developer tools with no login required.