Security Headers Analyzer
NewPaste raw HTTP response headers and get a checklist audit of common security headers like HSTS, CSP, and X-Frame-Options.
Frequently Asked Questions
Where do I get the raw headers to paste in?
Run something like curl -I https://example.com from a terminal, or open your browser's DevTools Network tab, click a request, and copy the Response Headers section — paste that raw block directly into the textarea.
Does this tool fetch the headers from my site automatically?
No — it never makes a network request. You paste headers you've already retrieved yourself, and all parsing and scoring happens locally in your browser.
Why is X-XSS-Protection marked as "legacy"?
It was a built-in filter in older versions of Chrome/Safari/IE that has since been removed from modern browser engines in favor of stronger protections like Content-Security-Policy — it's included here mainly for completeness/backward compatibility with older clients, not as a primary defense.
Is a perfect score required for a "secure" site?
Not necessarily — not every header applies to every site (for example, Cross-Origin-Opener-Policy mainly matters if you need cross-origin isolation for specific APIs). Treat the checklist as a prompt to deliberately decide whether each header applies to your situation, not a mandatory pass/fail gate.
Does header order or capitalization matter for this parser?
No — header names are matched case-insensitively and in any order, since HTTP header names are defined to be case-insensitive and header order is not semantically significant.