How to use the http security headers analyzer
- Copy the response headers of a page, from your browser's network panel or from a command such as curl -I, and paste them into the box.
- Read the counts of headers present, to review and missing.
- Go down the table to see what each header says. Cookies are listed one by one.
- Change the headers on your server, fetch them again and check the new list.
Formula
Strict-Transport-Security needs max-age, and a value of 0 switches the policy off
X-Content-Type-Options takes one value, nosniff
Referrer-Policy takes one of eight keywords, and X-Frame-Options takes DENY or SAMEORIGIN
a cookie is checked for the Secure, HttpOnly and SameSite attributes, and SameSite=None must come with Secure
The Content-Security-Policy is read directive by directive. The tool flags unsafe-inline and unsafe-eval in script sources, broad sources such as * or https:, and a policy with no script-src or default-src.
A response with a mix of settings
The sample has Strict-Transport-Security with max-age 31536000 (about 365 days) and subdomains, X-Content-Type-Options set to nosniff, and Referrer-Policy strict-origin-when-cross-origin. Those three are present. The Content-Security-Policy allows unsafe-inline for scripts, so it is marked for review.
The cookie session has HttpOnly but no Secure or SameSite, and the cookie theme has Secure and SameSite=Lax but no HttpOnly, so both are marked for review. The server line shows nginx/1.24.0 with a version number, which is also reviewed. X-Frame-Options, Permissions-Policy and the three Cross-Origin policies are missing. That is 3 present, 4 to review and 5 missing.
What each group of headers does
Some headers tell the browser to insist on HTTPS, some limit where scripts and frames can load from, some stop the browser from guessing file types, and some control how much of the address is sent to other sites. Cookie attributes limit when and to whom a cookie is sent. A header that is missing is the browser default, which may be fine for a simple page.
To build a policy, use the Content Security Policy Builder. Related files for a site are made with the Robots.txt Generator and the Sitemap XML Generator, and the markup of the page can be checked with the HTML Accessibility Snippet Checker.
Reading Missing and Review
Missing is not a verdict. Some headers matter for sites that handle logins or user content, and others are optional. Review means a header is sent but contains a value that deserves a look, such as a very broad source in a policy. The tool applies no scoring, because the right headers depend on the site.
Assumptions and limits
- The headers belong to a single response, copied as plain text with one header per line.
- Names are not case sensitive, and a line that starts with white space continues the one above.
- Repeated headers other than Set-Cookie are joined with a comma.
- Up to 50,000 characters are read once, and nothing is sent anywhere.
Frequently asked questions
Does this scan my website?
No. It reads only the text you paste. It does not connect to any site, so the result is as current as the headers you copied.
Why is a missing frame header sometimes fine?
The frame-ancestors directive of a Content-Security-Policy does the same job as X-Frame-Options, so if that directive is present the tool shows the header as a note instead of missing.
What is a report-only policy?
A Content-Security-Policy-Report-Only header tells the browser to report problems without blocking anything. It is useful while testing a policy, but it does not protect anyone, so the tool marks it for review.
Why does the Server header need review?
A version number in it tells visitors exactly what software runs the site, which helps anyone looking for known weaknesses. Hiding the version is a small step and not a replacement for updating the software.