Security Headers Analyzer
Paste HTTP response headers to review common security-related fields, their current values, and clear syntax or configuration concerns. Analysis runs entirely in your browser and does not scan a site, verify HTTPS, or check preload registration.
Review pasted response headers for a focused set of browser security headers and structural issues without performing a live security scan.
How to analyze security headers
- Paste a full HTTP response header block.
- Review CSP, HSTS, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, and optional supported headers.
- Inspect error and review notices produced by the built-in parsers.
What the analyzer checks
Core headers are CSP, HSTS, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy; CSP Report-Only, X-Frame-Options, and X-XSS-Protection are also shown when present.
Implemented checks include broad or unsafe CSP sources, HSTS max-age problems, non-nosniff X-Content-Type-Options, unknown Referrer-Policy tokens, malformed Permissions-Policy syntax, and unusual X-Frame-Options values.
Privacy and limitations
The analyzer only inspects pasted header text in your browser. It does not test real browser enforcement, application code, certificates, redirects, or prove that a site is secure.
Security Headers Analyzer FAQ
Does it scan a live domain?
No. It analyzes pasted headers only.
Which headers are core?
CSP, HSTS, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy.
Does it inspect CSP values?
Yes, within the rules implemented by this parser.
Does a clean result prove security?
No. This is a limited structural review.
Is header data uploaded?
No. Processing is browser-local.