Security Headers Checker

Paste raw HTTP response headers to audit CSP, HSTS, X-Frame-Options, nosniff, Referrer-Policy, Permissions-Policy, COOP, and CORP locally.

Security Headers Checker tool interface

About Security Headers Checker

The Security Headers Checker by ToolTux helps web developers, site reliability engineers, and security learners audit raw HTTP response headers against eight modern browser defense-in-depth directives locally in the browser. Modern browsers include built-in protections against cross-site scripting (XSS), clickjacking, MIME-type sniffing, protocol downgrade attacks, and cross-origin leaks—but those protections activate only when your web server sends explicit response headers. With this tool, you paste raw response headers captured from browser DevTools or curl -I and click Audit Headers to evaluate Strict-Transport-Security (HSTS), Content-Security-Policy (CSP), X-Frame-Options (or CSP frame-ancestors), X-Content-Type-Options, Referrer-Policy, Permissions-Policy, Cross-Origin-Opener-Policy (COOP), and Cross-Origin-Resource-Policy (CORP). Each check reports Present, Weak, or Missing status with a plain-English explanation—flagging short HSTS max-age values under six months, unsafe-inline or unsafe-eval CSP rules, or missing nosniff directives—and computes a transparent hardening score strictly from those eight checks without contacting external URLs.

Audit pasted HTTP response headers directly in your browser against eight modern web security directives, with clear Present, Weak, or Missing ratings and remediation notes.

How to Use Security Headers Checker

  1. Capture raw HTTP response headers from your browser Network tab (Response Headers) or by running curl -I https://your-domain.example in a terminal.
  2. Paste the raw header lines into the Security Headers Checker textarea (or click Insert example to test a sample response).
  3. Click Audit Headers to evaluate all eight security headers locally in your browser.
  4. Review your calculated hardening score along with Present, Weak, and Missing badges for each directive.
  5. Update your web server, CDN, or static host configuration based on the notes and re-paste headers to confirm improvements.

Common Use Cases

  • Auditing HTTP response headers from staging or localhost servers that are not reachable by public scanners.
  • Checking Strict-Transport-Security max-age values, Content-Security-Policy directives, and anti-clickjacking headers before launch.
  • Learning what each of the eight core browser security headers protects against during web security study.

Frequently Asked Questions

Does this tool send network requests to a target website URL?
No. You paste raw HTTP response headers directly into the editor, and all eight checks run locally in your browser.
Which eight HTTP security headers are checked?
It evaluates Strict-Transport-Security, Content-Security-Policy, X-Frame-Options (or CSP frame-ancestors), X-Content-Type-Options, Referrer-Policy, Permissions-Policy, Cross-Origin-Opener-Policy, and Cross-Origin-Resource-Policy.
Why is Strict-Transport-Security marked Weak when max-age is small?
HSTS max-age values shorter than six months (15552000 seconds) expire quickly in browsers, leaving infrequent visitors vulnerable to downgrade attacks.
What is the difference between X-Frame-Options and CSP frame-ancestors?
Both prevent clickjacking in iframes; CSP frame-ancestors is the flexible modern standard while X-Frame-Options provides legacy browser support.

Related Ethical Hacking & Cybersecurity Tools

  • URL Encoder & Decoder — Percent-encode or decode URL query parameters, special characters, and full URI paths securely.
  • Password Generator — Generate strong cryptographically random passwords with custom symbols, numbers, and length parameters.
  • Password Strength Checker — Analyze password entropy, crack time estimation, character composition, and security vulnerabilities.
  • Hash Generator — Compute cryptographic hashes (MD5, SHA-1, SHA-256, SHA-512) for any text string instantly.