HTTP Security Headers Checker
Grade pasted response headers and get a recommended security header block.
This tool does not fetch any URL. Paste headers you copied yourself, for example from curl -I https://example.com or your browser's developer tools (Network tab, select the page request, Response Headers).
Recommended headers
A starting point that scores A+. Tailor the Content-Security-Policy to your site (the CSP Header Generator can help) and test before deploying.
Use via API
Grade pasted HTTP response headers (A+ to F) for security: CSP, HSTS, framing, nosniff, Referrer-Policy, Permissions-Policy, cross-origin policies, cookies and information leaks. Nothing is fetched. Send JSON, get JSON back.
POST https://pithlab.com/api/v1/tools/security-headers-checker
curl https://pithlab.com/api/v1/tools/security-headers-checker \
-H "Authorization: Bearer $PITHLAB_KEY" \
-H "Content-Type: application/json" \
-d '{"headers":"HTTP/2 200\ncontent-type: text/html; charset=utf-8\nstrict-transport-security: max-age=31536000; includeSubDomains\nx-content-type-options: nosniff\nx-frame-options: SAMEORIGIN\nreferrer-policy: strict-origin-when-cross-origin\nserver: nginx/1.25.3"}'About the Security Headers Checker
Paste HTTP response headers to grade them A+ to F: HSTS, CSP, framing, cookies, COOP, CORP and version leaks, with fixes for Nginx and Apache. Fetches nothing.
How to use the Security Headers Checker
- Get the response headers: run curl -I https://example.com, or copy them from the Network tab of your browser's developer tools.
- Paste them into the box. Status lines, folded lines, duplicate headers and several redirects in a row are all handled.
- Read the grade and the explanation for each header, including what to change.
- Copy the recommended header block for Nginx or Apache, adjust the Content-Security-Policy to suit your site, and test before deploying.
Examples
Input
HTTP/2 200 strict-transport-security: max-age=63072000; includeSubDomains; preload content-security-policy: default-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none' x-content-type-options: nosniff referrer-policy: strict-origin-when-cross-origin permissions-policy: camera=(), microphone=(), geolocation=() cross-origin-opener-policy: same-origin cross-origin-resource-policy: same-origin
Output
Grade A+ (100/100)
Input
HTTP/1.1 200 OK Strict-Transport-Security: max-age=31536000 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Content-Security-Policy: script-src 'self' 'unsafe-inline'
Output
Grade B (70/100)
Input
HTTP/1.1 200 OK Server: Apache/2.4.41 (Ubuntu) X-Powered-By: PHP/7.4.3 Content-Type: text/html; charset=UTF-8 Set-Cookie: PHPSESSID=abc123; path=/
Output
Grade F (0/100)
Frequently asked questions
Does this tool fetch my website?
No. It only reads the headers you paste and never requests any URL, so it works for intranet and staging sites too. A version that fetches a URL from a server may be added later.
How is the grade worked out?
Content-Security-Policy and Strict-Transport-Security are worth 25 points each, framing protection 15, X-Content-Type-Options and Referrer-Policy 10 each, and Permissions-Policy, COOP and CORP 5 each. Points are deducted for weak cookies and version leaks. A+ needs 95 or more, and A or A+ need both CSP and HSTS.
Should I copy the recommended block as it is?
The HSTS, nosniff, referrer and cross-origin headers are safe for most sites. The Content-Security-Policy is a strict starting point that can block inline scripts, analytics or third-party widgets, so test it first, perhaps as Content-Security-Policy-Report-Only.
Why are X-Frame-Options and frame-ancestors both mentioned?
They do the same job. CSP frame-ancestors is the modern, more flexible version, and browsers ignore X-Frame-Options when it is present. Sending both is harmless and helps very old browsers.
Are the headers I paste sent anywhere?
No. Parsing and grading run in your browser, so cookies or internal host names in the headers stay on your device.