Free Handy Tools

Security Headers Analyser

This reads text you paste and makes no request of its own. It cannot fetch a domain for you, deliberately: a tool that took a hostname and went and asked it for headers would be pointing a scanner at hosts its visitors may not own, and would be sending us somebody else’s address into the bargain.

Try one

A status line, curl’s < prefixes, folded continuation lines and blank lines are all fine. Repeated headers are combined the way a browser combines them, except Set-Cookie, which never is.

Assessment

Paste a set of response headers and each one is judged here.

Findings

  • SeriousContent-Security-Policy is not being sent

    Any HTML injection on this page becomes script execution, because nothing tells the browser which sources are legitimate. This is the header that changes the outcome of the bug class rather than the odds of it.

    CSP Level 3

  • SeriousStrict-Transport-Security is not being sent

    A visitor who types the bare domain, or follows an old http:// link, makes one plaintext request that can be answered by whoever is between them and you. Redirecting to https is not a substitute: the redirect itself travels in the clear.

    RFC 6797

  • Worth fixingX-Content-Type-Options is not being sent

    The browser may sniff a response body and decide it is HTML or script despite the declared type. On any endpoint that serves files people uploaded, that is how a text file becomes a script on your origin.

    Fetch Standard, determine nosniff

  • Worth fixingX-Frame-Options is not being sent

    Nothing stops another site framing this page. Send a CSP frame-ancestors directive instead if you would rather have one mechanism — but one of the two has to be there.

    RFC 7034

  • MinorReferrer-Policy is not being sent

    The browser falls back to its own default, and current Chrome and Firefox default to strict-origin-when-cross-origin, so the practical exposure is smaller than it used to be. Stating it is still cheaper than depending on it.

    W3C Referrer Policy

  • MinorPermissions-Policy is not being sent

    Features are governed by browser defaults, which for camera, microphone and geolocation already require a user prompt. The header is what keeps a third-party frame from being the thing that asks.

    W3C Permissions Policy

What is not being sent

  • Content-Security-Policy

    Turns an HTML injection into a blocked resource instead of executing script, by naming where script, style, frames and connections may come from.

  • Strict-Transport-Security

    Stops the first request going out in plaintext on every visit after the first, so a network attacker cannot strip TLS or redirect the http:// version.

  • X-Content-Type-Options

    Stops the browser second-guessing a declared Content-Type, so an uploaded file served as text/plain is never treated as script or HTML.

  • X-Frame-Options

    Stops another site framing this page invisibly and collecting clicks meant for its own interface.

  • Referrer-Policy

    Stops a full URL — including a path or query string holding a token, an order number or a search — being handed to every site you link to or load from.

  • Permissions-Policy

    Turns off device and browser features for this document and anything it frames, so a compromised third-party embed cannot ask for the camera in your name.

What each header buys you

Every HTML response should carry these

  • Content-Security-PolicyTurns an HTML injection into a blocked resource instead of executing script, by naming where script, style, frames and connections may come from.CSP Level 3
  • Strict-Transport-SecurityStops the first request going out in plaintext on every visit after the first, so a network attacker cannot strip TLS or redirect the http:// version.RFC 6797
  • X-Content-Type-OptionsStops the browser second-guessing a declared Content-Type, so an uploaded file served as text/plain is never treated as script or HTML.Fetch Standard, determine nosniff
  • X-Frame-OptionsStops another site framing this page invisibly and collecting clicks meant for its own interface.RFC 7034
  • Referrer-PolicyStops a full URL — including a path or query string holding a token, an order number or a search — being handed to every site you link to or load from.W3C Referrer Policy
  • Permissions-PolicyTurns off device and browser features for this document and anything it frames, so a compromised third-party embed cannot ask for the camera in your name.W3C Permissions Policy

Right for some responses, wrong for others

  • Cross-Origin-Opener-PolicySevers the window relationship with a page that opened yours or that you opened, which closes cross-window scripting and the tabnabbing family.HTML Standard
  • Cross-Origin-Embedder-PolicyRefuses cross-origin subresources that have not opted in, which is the second half of the cross-origin isolation requirement.HTML Standard
  • Cross-Origin-Resource-PolicyStops another site embedding this response at all, which is the defence against side-channel reads of a resource the attacker can never see directly.Fetch Standard, cross-origin resource policy
  • Cache-ControlKeeps a page rendered for one signed-in person out of shared caches and off the disk of a shared machine.RFC 9111
  • Set-CookieNothing by itself — its attributes are where the protection lives.RFC 6265bis
  • Access-Control-Allow-OriginNothing. It is a relaxation of the same-origin policy, and it needs reading as one.Fetch Standard, CORS protocol

Remove these if you find them

  • X-XSS-ProtectionNothing any more. It configured a reflected-XSS filter that no current browser ships.never standardised
  • Expect-CTNothing now. Certificate Transparency enforcement moved into the browsers themselves.RFC 9163, retired
  • Public-Key-PinsNothing. Browsers removed HTTP Public Key Pinning.RFC 7469, obsolete
  • ServerNothing. It describes the software answering the request.RFC 9110 § 10.2.4
  • X-Powered-ByNothing. It advertises the framework.no specification

A full set of headers is not the same as a secure application. Every one of these narrows what a bug can be turned into; none of them fixes the bug. A page with all six and a broken authorisation check is still wide open.

Six promises a response can make

A response header is a short instruction to the browser about how to treat the document arriving with it. Six carry most of the weight. Content-Security-Policy limits what an injection is able to execute. Strict-Transport-Security removes the plaintext request that would otherwise start every visit. X-Content-Type-Options prevents a file being re-interpreted as something more dangerous than its declared type. X-Frame-Options, or a frame-ancestors directive doing the same job, keeps the page out of a stranger’s frame. Referrer-Policy keeps your own URLs out of other people’s access logs. Permissions-Policy switches off device features the page has no use for.

Not one of them repairs a defect. Each narrows what a defect can be escalated into, which is a cheaper class of win altogether: they are configuration rather than code, and they take effect across every route at once.

Headers that have stopped doing anything

X-XSS-Protection configured a filter Chrome removed in 2019 and Firefox never shipped. Expect-CT is published as Historic, because certificate transparency is now demanded of publicly trusted certificates whether a site asks for it or not. Public-Key-Pins was withdrawn from browsers after too many operators pinned themselves off the internet for the length of their own max-age.

All three are inert. The cost of keeping them is not the handful of bytes; it is that a reader mistakes them for protection. Server and X-Powered-By are the same problem pointing the other way, telling anyone sorting hosts by exploit which published vulnerability to try against yours first.

The two that only mean something together

Cross-Origin-Opener-Policy severs the window relationship between your document and whatever opened it. Cross-Origin-Embedder-Policy refuses cross-origin subresources that have not explicitly opted in. Set to same-origin and require-corp, the pair makes a document cross-origin isolated, which is the gate on SharedArrayBuffer and on timers that are not deliberately blunted.

This is not general hardening. Enabling the second one breaks every cross-origin image, font and frame that does not send a Cross-Origin-Resource-Policy of its own, so it is a migration to plan rather than a line to add on a Friday afternoon.

Why this will not go and look for you

A scanner that accepts a domain name and fetches it is issuing requests to a host on a stranger’s say-so, with no way of knowing whether the person typing owns it. It would also put that domain in our logs, and not doing that is a commitment this site’s privacy policy makes explicitly.

So this reads pasted text and nothing else. Open the network panel, click the document request, and copy the response headers; or run curl with the -I flag and paste what comes back. Either way the assessment happens on your machine.

Common questions about response headers

Do I need to be on the HSTS preload list?

Only if you want the very first visit protected too, before any header has been seen. Submission requires a year of max-age, includeSubDomains and the preload token, and removal takes months, so it commits every subdomain you will ever create to HTTPS.

Is X-Frame-Options redundant once I have a policy?

Where a Content-Security-Policy carries frame-ancestors, browsers enforce that and ignore the older header entirely. Sending both is harmless belt and braces for anything that only understands the header, and the directive is the one to edit.

Does no-cache keep a page out of the cache?

No, and the name is the trap. It means revalidate before reusing, and the copy is stored either way. The directive that says do not keep this at all is no-store, which is what a page rendered for one signed-in person needs.

What is a sensible Permissions-Policy to begin with?

Deny the features you are certain you do not use, written as an empty allowlist: camera=(), microphone=(), geolocation=(). That is exactly what this site sends. Adding more is easy once you know which frames on the page need what.

Does a full set of headers mean the site is secure?

It means one class of attack got harder. An authorisation check that trusts a parameter, or a query built by string concatenation, is untouched by anything in this list. Headers are the cheap layer, not the important one.

Sources

Last reviewed 27 August 2026