Security Headers Analyzer

Response headers carry most of a website's real browser-enforced security policy, yet reading them by eye is easy to get wrong: a Content-Security-Policy can look strict at a glance while quietly allowing 'unsafe-inline' scripts, and a Strict-Transport-Security header can be present with a max-age so short it barely does anything. This tool takes the raw header block you paste in — copied straight from curl -I, Postman, or a browser DevTools Network tab request — and runs it through the same category of checks used by well-known online header graders, entirely in your browser. Nothing is fetched: whatever you paste is all that gets analyzed, which means it works identically for a public production site, an internal staging server, or an endpoint sitting behind a firewall that no external scanner could ever reach.

The centerpiece is a real Content-Security-Policy grammar parser, not a checklist. The header's value is split on semicolons into directives, and each directive's source list is split and inspected on its own terms: script- and style-related directives are flagged if they allow 'unsafe-inline' or 'unsafe-eval', any directive is flagged for a bare wildcard '*' source (with extra severity when that wildcard sits on script-src, object-src, base-uri or default-src), broad scheme sources like 'https:' on a script directive are called out as nearly as permissive as a wildcard, and the policy as a whole is checked for a missing default-src fallback and for deprecated directives (block-all-mixed-content, plugin-types, referrer, reflected-xss) that modern browsers simply ignore. A CSP sent only as Content-Security-Policy-Report-Only is recognized and flagged as not actually enforced yet, distinct from a fully missing policy.

Beyond CSP, the tool checks Strict-Transport-Security by parsing its own max-age directive and flagging values under roughly six months as too short to be meaningfully effective, plus whether includeSubDomains and preload are set. X-Content-Type-Options must be the exact string 'nosniff' or it is flagged as ignored by browsers. X-Frame-Options is checked for DENY or SAMEORIGIN, but the tool is also aware that a CSP frame-ancestors directive is the modern replacement for click-jacking protection — if that is present, X-Frame-Options is treated as covered even when the legacy header itself is absent. Referrer-Policy is checked against the real list of valid keywords and flagged if set to the URL-leaking 'unsafe-url' value, Permissions-Policy is checked for presence, and every Set-Cookie line found is parsed for its own Secure, HttpOnly and SameSite attributes, including the specific rule that SameSite=None cookies without Secure get silently rejected by browsers.

Every check produces one of three honest states — good, needs attention, or missing — with a plain-English explanation of why that header matters for real attacks (XSS, clickjacking, cookie theft, protocol downgrade), and the overall A-F grade is a transparent sum of per-header points rather than a black-box score. The full report can be copied as plain text in one click for pasting into a pull request, ticket or security review, and because parsing happens entirely from the pasted text, this tool is equally useful for auditing your own site's headers, reviewing a vendor's response before integrating with them, or double-checking a configuration change before it ships.