Paste your response headers and see a clear A–F security grade with a per-header breakdown: every missing or weak HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy and Permissions-Policy flagged with a copy-ready fix.
The Security Header Checker parses pasted HTTP response headers and grades the six defensive headers, HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy and Permissions-Policy, as pass, warn or fail with copy-ready fixes and an A–F score. Free and browser-based, so it works on staging and login-gated pages a public scanner can't reach.
The GigAI Security Header Checker turns a raw block of HTTP response headers into an actionable security report. Paste the output of `curl -I https://yoursite.com`, copy the Response Headers straight from your browser's DevTools Network panel, or drop a saved header dump, and the tool parses it with the same case-insensitive folding real clients use: then scores the six headers that most affect a site's defensive posture. Strict-Transport-Security is checked for an adequate max-age and includeSubDomains. Content-Security-Policy is inspected for a default-src fallback and risky `unsafe-inline` / `unsafe-eval` allowances. X-Frame-Options and CSP frame-ancestors are read for clickjacking cover. X-Content-Type-Options is verified as `nosniff`, and Referrer-Policy and Permissions-Policy are checked for sane, privacy-preserving values. Each header earns a pass, warn or fail with a one-line explanation of the real-world risk and a fix you can copy straight into Nginx, Apache, Cloudflare, a CDN rule or a framework middleware. A weighted 0–100 score rolls up into a familiar A–F grade so you can track hardening over time and prove progress to a client or auditor. Because everything is computed locally in your browser from the text you paste, nothing is uploaded, logged or fetched, which means it works perfectly on staging URLs, internal tools and login-gated pages that a public online scanner can never reach.
Last updated
Run `curl -sI https://yoursite.com`, or open DevTools → Network, click the document request, and copy everything under Response Headers.
Drop the raw header block into the input. A leading status line like `HTTP/2 200` is fine, it's detected and skipped automatically.
See your A–F grade, then scan the per-header list to find every missing, weak or passing control with a clear explanation of the risk.
Copy each suggested header line into your server or CDN config, redeploy, then paste the new headers back in to confirm the grade improved.
A weighted 0–100 score and letter grade summarise your posture at a glance, built from HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy and Permissions-Policy.
Every header gets its own verdict with the exact value found, so you see precisely which control is missing, weak or already solid. Not just a single number.
Each warning and failure comes with a ready-to-paste header line you can drop into Nginx, Apache, Cloudflare, a CDN rule or framework middleware. No spec-hunting.
Understands curl -I output, DevTools Response Headers and raw dumps, folding duplicate headers and ignoring the status line exactly like a real HTTP client.
Goes beyond presence: flags a short HSTS max-age or missing includeSubDomains, and warns when a CSP relies on unsafe-inline / unsafe-eval or has no default-src fallback.
Copy the full audit to your clipboard or export it as a text file to attach to a ticket, a pentest remediation list or a client hardening report.
Instead of a vague 'add security headers', you get the specific missing control and the exact line to add, closing clickjacking, MIME-sniffing and mixed-content gaps that a plain audit glosses over.
Because it works on pasted text, you can grade staging environments, internal dashboards and authenticated routes that a public online scanner can never reach.
The repeatable A–F grade lets you snapshot before-and-after states, so you can show a client, manager or auditor that a change moved the needle.
Your headers may reveal server software, tokens or internal hostnames. Here they never leave the browser: nothing is uploaded, fetched or logged.
From quick one-off fixes to daily workflows, see how people put this tool to use.
Paste headers from any environment and get a prioritised list of missing controls with fixes, turning a fuzzy 'harden the headers' ticket into concrete, copy-ready changes.
After adding headers at Nginx, Cloudflare or a load balancer, confirm they arrive correctly on the response and that HSTS and CSP are actually strong, not just present.
Check your app's responses before launch so clickjacking, MIME-sniffing and downgrade attacks are covered, and the CSP doesn't quietly rely on unsafe-inline.
Grade a client's headers, export the report, and deliver a short remediation list that demonstrates due diligence and adds value beyond the build.
Accepts HTTP headers and Text, and produces Security report and Text, all processed locally in your browser.
Paste raw HTTP response headers to parse them into a clean table and get instant notes on status, redirects, caching, compression, cookies, CORS and a graded security-header report, 100% in your browser.
Paste a page's HTML to audit its title, description, canonical, robots, Open Graph and Twitter Card tags: with a length score, missing/duplicate checks and a live search & social preview, 100% in your browser.
Paste your robots.txt to parse it into User-agent groups and catch the mistakes that block Google: a stray Disallow: /, rules before any User-agent, unknown directives and a missing sitemap. 100% in your browser.
Format, validate and minify JSON in your browser with pinpoint error line + column, jump-to-error, key sorting and live editing: nothing is uploaded.
Paste any URL and instantly break it into protocol, host, port, path, every query parameter, hash and origin, with a live rebuilt URL to confirm the parts. 100% in your browser.
Build a correct Content-Security-Policy header from a friendly per-directive form (script, style, img, connect, font and frame sources) with a plain-English explanation and a live strictness meter. 100% in your browser.
Hit a snag? Here are quick fixes for the issues people run into most.
No, and that's deliberate. Fetching another site's headers from the browser is blocked by CORS, and doing it server-side would mean sending your URL to us. Instead you paste the headers (from curl or DevTools), which also lets you audit staging and login-gated pages a public scanner can't see.
The checker looks past mere presence. A warn usually means your policy allows `unsafe-inline` or `unsafe-eval` (which reopens the XSS hole CSP is meant to close) or lacks a `default-src` fallback. Move inline scripts to nonces or hashes and add a restrictive default-src to earn a pass.
A common cause is a max-age shorter than the recommended six months (15552000 seconds) or a missing `includeSubDomains`. Use `Strict-Transport-Security: max-age=31536000; includeSubDomains; preload` once you're confident every subdomain is HTTPS-only.
Make sure each header is on its own line in `Name: value` form. Copying from a formatted table can merge cells: grab the raw text (curl -I is the most reliable source) and re-paste. Blank lines and a leading HTTP status line are handled for you.
Prefer a CSP with `frame-ancestors 'none'` over X-Frame-Options for modern browsers, but keep X-Frame-Options too for older ones.
Only add `preload` to HSTS once every subdomain is HTTPS-only. Preloading a broken subdomain is hard to undo.
Set `X-Content-Type-Options: nosniff` everywhere, it's a one-line header that stops a whole class of content-type confusion attacks.
Start a CSP in report-only mode (`Content-Security-Policy-Report-Only`) to catch violations before you enforce and risk breaking the page.
`Referrer-Policy: strict-origin-when-cross-origin` is a strong default that keeps analytics working while not leaking full URLs to third parties.
Recent updates and improvements to the security header checker.
Initial release. Paste response headers for an A–F security grade with per-header pass/warn/fail on HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy and Permissions-Policy, each with a copy-ready fix.
Deepened CSP inspection (unsafe-inline / unsafe-eval and missing default-src detection) and HSTS checks (max-age threshold, includeSubDomains), plus a parsed-headers summary and copyable fix snippets.
Added report copy/export, a real-world sample header set, and clearer risk explanations for every verdict.
Every check runs locally in your browser on the text you paste. Your headers are never uploaded, fetched or logged. That matters because response headers can expose server versions, internal hostnames, session cookies or CSP report endpoints. Here they stay on your device, so it's safe to audit staging, intranet and authenticated pages, and closing the tab erases everything.
Free, private and instant. Security Header Checker runs right in your browser.
