Runs locally in your browser. Nothing you enter is uploaded to our servers.
Result will appear here
Tips for security headers
Paste response headers from the real production URL you care about.
CSP needs tuning — a missing header is a finding, a broken CSP is too.
HSTS only helps over HTTPS and after the first successful visit.
Compare staging vs production — configs often diverge.
Fix headers in the server/CDN config, not only in docs.
Read pasted security headers
Processing stays in your browser — your input is not uploaded to our servers.
Paste a `curl -I` or DevTools response header block to see CSP, HSTS, X-Frame-Options, and friends. The tool does not fetch your site.
A missing header in the paste means you did not include it — or the server did not send it — not that we scanned the internet.
Analyze response headers
Copy headers from the real response
Status line plus header block. HTML body is noise here.
Paste and inspect
Look for HSTS on HTTPS, a CSP that is not `unsafe-inline` everywhere, and clickjacking defenses.
Fix on the server
This page only reads. Set headers in nginx, the app, or the CDN.
Security headers FAQ
Do you crawl my domain?
No. There is no URL fetch. If you need a live pull, use your own curl.
Is the paste uploaded?
No. Parsing is local.
Green on this page means production is safe?
It means this header set looks reasonable. Cookies, TLS, and app bugs are out of scope.