HTTP Security Headers Analyzer
Paste response headers (from DevTools or curl -I) to grade HSTS, CSP, X-Frame-Options, Referrer-Policy, cookies and leaks, with a fix snippet for each issue.
Points: CSP 25, HSTS 20, framing 15, nosniff 15, Referrer-Policy 15, Permissions-Policy 10; minus 5 for each version leak or X-XSS-Protection, and 3 for each cookie missing a flag (at most 20). This is this page’s own scale, similar in spirit to public header scanners, not an official rating.
Headers are only part of security: they do not fix vulnerable code. HSTS is ignored on plain-HTTP responses, so check the HTTPS response.
The advice follows the OWASP HTTP Security Response Headers Cheat Sheet and MDN as checked in November 2026.
| Header | Status | Details | Suggested fix |
|---|---|---|---|
| Strict-Transport-Security | Warning | max-age is 86400 seconds (1 days); at least one year (31536000) is recommended. | Strict-Transport-Security: max-age=31536000 |
| Content-Security-Policy | Missing | No CSP: injected scripts (XSS) run without restriction. | Content-Security-Policy: default-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self' |
| Clickjacking (frame-ancestors / X-Frame-Options) | Good | X-Frame-Options: SAMEORIGIN. | |
| X-Content-Type-Options | Missing | Browsers may treat uploads or text files as scripts or HTML (MIME sniffing). | X-Content-Type-Options: nosniff |
| Referrer-Policy | Missing | Browsers default to strict-origin-when-cross-origin today, but setting it explicitly protects older browsers. | Referrer-Policy: strict-origin-when-cross-origin |
| Permissions-Policy | Missing | Optional but recommended: switch off features the site does not use. | Permissions-Policy: camera=(), microphone=(), geolocation=() |
| Cross-Origin-Opener-Policy | Info | Not set. same-origin isolates the page from cross-origin pop-ups (protects against XS-Leaks). | Cross-Origin-Opener-Policy: same-origin |
| Cross-Origin-Resource-Policy | Info | Not set. Controls which sites may embed this resource. | Cross-Origin-Resource-Policy: same-origin |
| Cross-Origin-Embedder-Policy | Info | Not set. Needed (with COOP) for cross-origin isolation features such as SharedArrayBuffer. | Cross-Origin-Embedder-Policy: require-corp |
| Server | Warning | Reveals the software version ("nginx/1.24.0"), which helps attackers pick exploits. | nginx: server_tokens off; Apache: ServerTokens Prod |
| X-Powered-By | Warning | Reveals the platform ("PHP/8.2.12"). | PHP: expose_php = Off; Express: app.disable("x-powered-by") |
| X-XSS-Protection | Warning | Deprecated: the old XSS filter it enables could itself be abused, and modern browsers removed it. Use CSP instead. | Remove it, or send X-XSS-Protection: 0 |
| Cookie | Flags | Suggested fix |
|---|---|---|
| session | Missing Secure, SameSite | Set-Cookie: session=…; Path=/; Secure; HttpOnly; SameSite=Lax |
HTTP response headers switch on browser defences: HSTS forces HTTPS, Content-Security-Policy limits scripts, X-Frame-Options stops clickjacking, nosniff stops MIME confusion, and cookie flags keep session cookies away from scripts and other sites. Paste the headers of any page — from your browser’s developer tools or curl -I — and this analyzer grades them, explains each finding and gives the line to add. Nothing is fetched: it only reads what you paste.
How to use this tool
- Run curl -sI https://your-site.example, or copy the response headers from the Network tab of the developer tools.
- Paste them into the box (the status line is ignored).
- Read the grade, then work through the Missing and Warning rows.
- Add the suggested lines to your server or CDN configuration and check again.
Formula
score = CSP 25 + HSTS 20 + framing 15 + nosniff 15 + Referrer-Policy 15 + Permissions-Policy 10 − deductions
A weak CSP earns 12 points and a report-only one 5; HSTS under one year earns 5–15. Deductions: 5 for each version leak (Server, X-Powered-By, X-AspNet-Version) and for an enabled X-XSS-Protection, 3 per cookie missing Secure, HttpOnly or SameSite, at most 20 in total. Grades: A+ = 95+ with no deductions, A ≥ 85, B ≥ 70, C ≥ 55, D ≥ 35, otherwise F.
Example
The sample headers (nginx and PHP versions shown, HSTS for one day, X-Frame-Options, a session cookie without Secure, and the old XSS filter) score 5 + 15 = 20 points minus 18 in deductions = 2 of 100, grade F. A response with all six recommended headers and no leaks scores 100, A+.
Frequently asked questions
Why doesn’t this page fetch my URL itself?
Browsers do not let a web page read another site’s response headers unless that site allows it (CORS), so a browser-only tool cannot fetch them. Pasting also lets you check internal or staging sites.
Is X-XSS-Protection still needed?
No. Modern browsers removed the XSS auditor, and its blocking mode could leak information. Remove the header or send 0, and rely on a Content Security Policy.
Should I add includeSubDomains and preload to HSTS?
Only when every subdomain serves HTTPS. Preload puts the domain into browsers’ built-in list, which is hard to undo; test with a short max-age first.
Sources
Last updated:
Page address with these inputs: https://kakao.mobile/tools/security-header-checker/
Cite or embed this tool
kakaoCalc. (2026, November 8). HTTP Security Headers Analyzer. https://kakao.mobile/tools/security-header-checker/
“HTTP Security Headers Analyzer.” kakaoCalc, 8 Nov. 2026, kakao.mobile/tools/security-header-checker/.
Paste this code into your page. The widget runs in your visitors' browsers, shows no ads and keeps a link back to this page. Embedding terms