Security Headers Auditor
Grade HTTP response headers against security best practices.
Response headers
Paste raw HTTP response headers (one per line).
Audit results
Analyzed locally — headers never leave your browser.
Paste response headers to see a graded security audit.
About the Security Headers Auditor
Paste raw HTTP response headers and get a graded checklist covering HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy, with concrete fixes for anything missing or weak.
Examples
Missing HSTS
X-Frame-Options: DENYOutput
Strict-Transport-Security: fail — missingRelated tools
CSP Builder
Security
Build a Content-Security-Policy header from per-directive sources.
CORS Config Generator
Security
Generate CORS headers/config for Nginx, Apache, Express, or Workers.
Htpasswd Generator
Security
Generate .htpasswd lines using SHA-1 or plain text.
JWT Inspector
Security
Decode a JWT and audit its claims for common issues.
Password Strength Checker
Security
Estimate password entropy, crack time, and get actionable advice.
Robots.txt Security Checker
Security
Scan robots.txt for accidental disclosure of sensitive paths.
Frequently asked questions
Read more
- Content Security Policy from scratch
CSP is one of the most effective defenses against XSS, and one of the easiest to get wrong. Here's how to build a policy that actually works.
Version 1.0.0 · Updated 2026-08-06 · Runs entirely in your browser