HTTP Security Headers Analyzer & Grading
Evaluate HSTS, CSP, X-Frame-Options, X-Content-Type-Options, and Referrer-Policy.
HTTP Security Headers Analyzer
Evaluate website security posture against XSS, Clickjacking, and MIME sniffing vulnerabilities.
About the HTTP Security Headers Analyzer
Scans your server's HTTP response headers and awards an A+ to F security posture grade based on the presence and correctness of key defensive headers.
How to Use
Enter any URL to test. The analyzer verifies Strict-Transport-Security (HSTS), Content-Security-Policy (CSP), X-Frame-Options, X-Content-Type-Options, and Referrer-Policy.
Understanding Results
Missing headers leave web applications vulnerable to Clickjacking, Cross-Site Scripting (XSS), and protocol downgrade attacks.
Frequently Asked Questions
How do I fix missing HSTS?
Add the 'Strict-Transport-Security: max-age=31536000; includeSubDomains; preload' header to your web server config.
Related Network & Security Utilities
Verify certificate validity, days remaining, cipher suites, issuer, and SAN coverage.
Trace 301, 302, 307, 308 redirect loops, affiliate links, and shortened URLs.
Check if a website is down or responding slowly from multiple global locations.
Test whether network ports (80, 443, 22, 21, 3306, 8080) are open, filtered, or closed.