Security Headers Auditor
Grade HTTP response headers against security best practices.
About the Security Headers Auditor
Paste raw HTTP response headers and get a graded checklist covering HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy, with concrete fixes for anything missing or weak.
Examples
Missing HSTS
YAMLX-Frame-Options: DENYOutput
YAMLStrict-Transport-Security: fail — missingKeyboard shortcuts
- Copy the main outputCtrl / ⌘ + Shift + C
- Download the resultCtrl / ⌘ + S
- Share this toolCtrl / ⌘ + Shift + S
- Reset the inputsAlt + R
- Open the tool search paletteCtrl / ⌘ + K
Related tools
CSP Builder
Security
Build a Content-Security-Policy header from per-directive sources.
Permissions-Policy Header Generator
Security
Build a Permissions-Policy header controlling camera, geolocation and more.
CORS Config Generator
Security
Generate CORS headers/config for Nginx, Apache, Express, or Workers.
Referrer Policy Generator
Security
Pick a Referrer-Policy value and get header/meta/server snippets.
Robots.txt Security Checker
Security
Scan robots.txt for accidental disclosure of sensitive paths.
X-Frame-Options / Clickjacking Checker
Security
Check if X-Frame-Options and CSP frame-ancestors block framing.
Frequently asked questions
Read more
- Content Security Policy from scratch
CSP is one of the most effective defenses against XSS, and one of the easiest to get wrong. Here's how to build a policy that actually works.
Version 1.0.0 · Updated 2026-08-06 · Runs entirely in your browser