Security Header Checker

Review headers you already captured

Paste raw HTTP response-header lines and select Review headers. The page checks for several common browser-facing policies and shows targeted notes. It never requests the site or verifies which response a visitor actually receives.

What this review covers

The checker looks for Content-Security-Policy, Strict-Transport-Security, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, and clickjacking protection through either CSP frame-ancestors or X-Frame-Options. These headers address different browser behaviors and are not interchangeable.

How pasted lines are parsed

Each line before the first colon becomes a case-insensitive field name; the remainder is its value. Continuation lines, developer-tool labels, proxy annotations, and non-header text are not reconstructed. Duplicate fields are combined for review, but real HTTP rules for duplicate values depend on the specific header.

Worked example

Paste Strict-Transport-Security: max-age=31536000, X-Content-Type-Options: nosniff, and Referrer-Policy: strict-origin-when-cross-origin. Those checks are recognized, while CSP, Permissions-Policy, and framing protection are reported for review if absent.

Presence is not correct configuration

A present policy can still be ineffective, overly broad, incompatible, duplicated incorrectly, or applied only on some routes. For example, a CSP containing unsafe sources may provide less protection than its presence suggests. This page performs limited syntax hints, not full policy evaluation or browser enforcement testing.

Capture the right response

Redirects, cached pages, service workers, CDNs, reverse proxies, authentication, geographic edges, and error routes can return different headers. Review the final HTTPS document response and important alternate responses with browser network tools or an authorized command-line request. Do not paste request headers by mistake.

Security and privacy limitations

The analysis runs locally and does not intentionally upload pasted text. Remove cookies, tokens, internal hostnames, tracing IDs, and other secrets before using any diagnostic page. A favorable summary is not a vulnerability scan, penetration test, compliance result, or guarantee that scripts and server behavior are secure.