Free Security Headers Analyzer

The Security Headers Analyzer is a free online tool that check website security headers and get improvement suggestions. It runs entirely in your browser with no installation or sign-up needed.

Yes, it is completely free with no registration required.

The Security Headers Analyzer checks for Content-Security-Policy, X-Frame-Options, HSTS, X-Content-Type-Options, Referrer-Policy, and other important security headers.

Absolutely. The Security Headers Analyzer processes everything client-side in your browser. No data is uploaded to or stored on any server. Your content remains private on your device at all times.

Yes, the Security Headers Analyzer is fully responsive and works on smartphones and tablets. You can use it on any device with a modern web browser -- no app download required.

No account or registration is needed. Simply open the Security Headers Analyzer in your browser and start using it immediately. There are no sign-up walls or usage restrictions.

Simply enter your input in the provided field, adjust any settings to your preference, and the tool will process it instantly. You can then copy the result to your clipboard or download it.

The Security Headers Analyzer works in all modern browsers including Chrome, Firefox, Safari, Edge, and Opera. For the best experience, use the latest version of your preferred browser.

Both headers limit how a page can be used, but they defend against different attacks. Content-Security-Policy (CSP) controls where a page is allowed to load resources from — scripts, styles, images, fonts, and frames — which makes it the strongest defense against cross-site scripting (XSS) and data injection. X-Frame-Options is narrower: it only controls whether your page can be embedded inside an iframe, which stops clickjacking, where an attacker overlays your site to trick users into clicking. CSP can actually replace X-Frame-Options using its frame-ancestors directive (set to 'none' to block all framing), so modern setups often rely on CSP for both. This analyzer tracks both headers, explains each one's purpose, and maps the specific attacks they prevent on its Reference tab so you can see exactly which protection you are missing.

Browsers enforce a cross-origin security restriction that blocks JavaScript on one site from reading another site's raw HTTP response headers. Because this tool runs entirely in your browser with no backend, it cannot fetch and parse the live headers of an external URL — that would require a server-side request to bypass the cross-origin rule. So the analyzer produces a simulated, illustrative assessment rather than a true live scan. The score, grade, and Present/Warning/Missing statuses are examples, not your real configuration. The genuinely accurate value lies elsewhere: the header reference, the attack-to-header mapping, and the copy-paste server configurations are all correct regardless of the demo scan. Use the demo to learn the landscape, then trust the Reference and Server Configs tabs to harden your actual site.

The grade is weighted by severity rather than counting every header equally, so the headers that matter most carry the most weight. Critical headers like HSTS, CSP, and X-Content-Type-Options are worth 20 points each, high-severity headers 15, medium 10, and low 5. A header that is fully present earns its full weight, a partially configured one earns half, and a missing one earns nothing; the total is then normalized to a 0–100 percentage. Roughly, 95 and above earns an A+, 90+ an A, 75+ a B, 60+ a C, and anything under 50 lands at D or F, with several plus and minus grades in between. The summary also surfaces how many critical headers are missing, so a single absent HSTS or CSP entry is impossible to overlook. Run a scan to see the weighting in action.

The recommended Strict-Transport-Security value is max-age=31536000; includeSubDomains; preload. HSTS forces browsers to connect over HTTPS only, blocking protocol-downgrade and man-in-the-middle attacks that exploit an initial insecure request. The max-age is in seconds, and 31536000 equals exactly one year — a long window so the browser keeps enforcing HTTPS between visits. includeSubDomains extends that protection to every subdomain, and preload signals that you want the domain baked into browsers' built-in HSTS preload list, so HTTPS is enforced even on a user's very first visit. This analyzer marks HSTS as a critical header and provides this exact value, ready to copy. Grab it from the tool's Server Configs tab, which generates matching Nginx, Apache, Express, and Next.js snippets you can paste straight into your config.

Once you know which headers are absent, the fix is a configuration change, not code. This tool's Server Configs tab generates ready-to-paste header snippets for four common stacks: Nginx using add_header directives, Apache using mod_headers, Express.js via the Helmet middleware, and Next.js using the headers() function in next.config.js. Each block uses the recommended values for every tracked header — for example nosniff for X-Content-Type-Options and a starter Content-Security-Policy — so you do not have to assemble them by hand. Copy the block for your platform, drop it into your server or app config, and reload or redeploy for the headers to take effect. After deploying, verify with your browser's network panel or a server-side header checker, since this analyzer's own scan runs in demo mode. Open the Server Configs tab to copy the snippet that matches your stack.