HTTP Security Header Analyzer

Browser security headers are the response fields that tell a browser how to constrain a page — enforce HTTPS, restrict where scripts may load from, refuse to be framed, and stop content-type sniffing. They are cheap to add and disproportionately effective. Paste a raw response header block and this analyzer parses it, checks the important controls, and returns per-header findings plus an overall grade.

What it checks. Strict-Transport-Security (HSTS) forces HTTPS and, with a long max-age, protects against TLS-stripping; the tool flags a missing or short max-age. Content-Security-Policy (CSP) is the strongest defense-in-depth against XSS; it warns when CSP is absent or weakened by unsafe-inline, unsafe-eval, or bare wildcards. X-Content-Type-Options: nosniff stops MIME sniffing. X-Frame-Options or CSP frame-ancestors prevents clickjacking. Referrer-Policy and Permissions-Policy limit referrer leakage and powerful browser features. It also flags version-disclosing Server/X-Powered-By headers and cookies missing HttpOnly.

How you'll use it. Grab the response headers with curl -I https://target or your browser's network tab, paste them, and read the findings. It is ideal for a quick pre-assessment pass, for documenting a baseline, or for validating that a fix actually shipped.

Common mistakes. Setting a CSP that includes 'unsafe-inline' — which defeats much of its XSS value — or configuring HSTS with a tiny max-age that never meaningfully protects. Another is relying on X-XSS-Protection, a legacy header modern browsers ignore; real protection comes from CSP and output encoding. Watch too for a header set on the redirect but not the final response, or a duplicated header where a proxy and the app both emit one and the browser uses only the first — grab the headers from the final 200 response, not a 301 hop, so you are grading what users actually receive.

Present is not the same as strong. The grade weighs quality, not mere presence. A CSP of default-src * technically "has a CSP" but permits everything; an HSTS header without includeSubDomains leaves sibling subdomains strippable; X-Frame-Options: ALLOW-FROM is obsolete and ignored by modern browsers, which honour only the CSP frame-ancestors directive. The analyzer flags these hollow configurations rather than rewarding the header's existence.

Defensive angle. Treat these headers as a baseline, not the whole story — they harden the browser side but do not fix server-side flaws. Aim for HSTS with includeSubDomains and a year-plus max-age, a strict nonce- or hash-based CSP without unsafe-inline, nosniff, clickjacking protection, and cookies marked Secure; HttpOnly; SameSite. A strong CSP is the backstop for a missed output-encoding bug, so pair this with the HTML entity encoder and the XSS payload reference to confirm your escaping holds where the header cannot. Re-run this check in CI so a regression is caught before it reaches production.