# Security Headers Checker Audit HTTP response headers for security compliance — parses the raw headers you paste (no network) and grades them against the OWASP secure-header set with value-level checks: HSTS max-age, CSP unsafe-inline/eval, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, COOP/COEP/CORP and more. Outputs a letter grade (A+ to F) plus per-header findings with copy-ready fix recommendations. > Canonical page: https://elysiatools.com/en/tools/security-headers-checker - **Category:** Security - **Keywords:** security headers, hsts, csp, content-security-policy, x-frame-options, x-content-type-options, referrer-policy, permissions-policy, coop, coep, corp, owasp, http, response headers, audit, grade ## Overview This tool audits **HTTP response headers for security compliance** by analyzing the raw headers you paste — it never makes a network request, so it works for internal/behind-auth/CORS-restricted sites, CI artifacts, or documentation examples. **How it differs from the HTTP Headers Analyzer:** that tool fetches a URL live and only checks header *presence* (boolean). This tool does deep **value-level** checks across a fuller header set. **What it checks (12 headers, value-level):** - **Critical** (missing or wrong = high risk): HSTS (max-age ≥ 31536000, includeSubDomains, preload), Content-Security-Policy (no unsafe-inline/unsafe-eval/wildcard, has default-src or script-src), X-Content-Type-Options (must be nosniff). - **Warning** (recommended): X-Frame-Options (DENY/SAMEORIGIN; notes CSP frame-ancestors supersedes it), Referrer-Policy (not unsafe-url/no-referrer-when-downgrade), Permissions-Policy. - **Info** (bonus isolation hardening): Cross-Origin-Opener-Policy, Cross-Origin-Embedder-Policy, Cross-Origin-Resource-Policy, X-Permitted-Cross-Domain-Policies, Clear-Site-Data, Cache-Control. **Input format:** raw HTTP response headers — one `Name: Value` per line, as produced by `curl -I`, browser DevTools Network tab, or HTTP dumps. Status lines (`HTTP/1.1 200 OK`) and blank lines are skipped automatically. **Grading** (deduction from 100): −20 per critical, −8 per warning. Letter grade from A+ to F. Each finding shows the current value, what's wrong, and a copy-ready recommended header value. This tool only inspects security headers — it does not check information-disclosure headers (Server/X-Powered-By) or cookie attributes. Use it to harden a site's response-header posture before shipping. ## Inputs - **Raw Response Headers** (textarea): Paste raw HTTP response headers, one "Name: Value" per line. For example: strict-transport-security: max-age=31536000; includeSubDomains; preload content-security-policy: default-src 'self' ## When to use - When auditing the security posture of internal, staging, or local development servers that cannot be accessed by public online scanners. - Before deploying a new web application to production to ensure critical security headers like HSTS and CSP are correctly configured. - When verifying HTTP response header configurations extracted from browser DevTools, curl outputs, or CI/CD build artifacts. ## How it works - Paste your raw HTTP response headers, such as those copied from browser DevTools or a curl command output, into the input area. - The tool automatically filters out status lines and blank lines, parsing each header name and value locally in your browser. - It evaluates the values against 12 key security headers, deducting points for missing or misconfigured critical and warning-level headers. - The checker outputs an overall letter grade from A+ to F, detailing specific findings and providing copy-ready recommended header values for remediation. ## Use cases - Auditing local development environments to verify Content Security Policy (CSP) directives before release. - Reviewing HTTP headers from a curl command output to ensure HSTS includes subdomains and preloading. - Validating security compliance of staging environments that are protected by basic authentication or IP whitelists. ## Frequently asked questions ### Does this tool make network requests to my website? No, it parses and audits the raw headers you paste entirely in your browser without making any network requests. ### What is the difference between this tool and a basic header analyzer? Basic analyzers only check if a header exists, while this tool performs deep value-level checks on parameters like HSTS max-age and CSP directives. ### Does it check cookie attributes or Server headers? No, this tool focuses exclusively on security headers and does not inspect cookie attributes or information-disclosure headers like Server or X-Powered-By. ### How is the letter grade calculated? The grade starts at 100, deducting 20 points for each missing or invalid critical header (HSTS, CSP, X-Content-Type-Options) and 8 points for each warning header. ### Can I use this for sites behind a login or firewall? Yes, since you copy and paste the headers manually, it works perfectly for local, firewalled, or authenticated environments. ## Related tools - [JWK Generator & Parser](https://elysiatools.com/en/tools/jwk-generator): Generate JSON Web Keys (JWK) for RSA, EC (P-256/P-384/P-521/secp256k1), and OKP (Ed25519/Ed448/X25519/X448), or parse an existing JWK to inspect its parameters, thumbprint, and metadata - [AI Domain Name Idea Generator](https://elysiatools.com/en/tools/ai-domain-name-idea-generator): Generate up to 10 creative domain names with AI and filter out already-registered ones via DNS + RDAP. - [Color Space Converter](https://elysiatools.com/en/tools/color-space-converter): Convert a color between HEX, RGB, HSL, CIELAB, and Display-P3 with CSS-ready output and gamut checks. - [Markdown Lint and Style Checker](https://elysiatools.com/en/tools/markdown-lint-style-checker): Lint Markdown against ~15 markdownlint rules plus 2 Chinese-typography rules, with line-located reports and one-click auto-fix of safe issues - [package.json Dependency Auditor](https://elysiatools.com/en/tools/package-json-dependency-auditor): Audit a package.json for dependency hygiene, version-range quality, and optionally inspect a transitive dependency tree from package-lock.json or yarn.lock. Flags duplicates, wildcard or pre-release specs, unsorted keys, missing metadata, and misclassified runtime/dev dependencies. - [Tailwind Color Palette Sync](https://elysiatools.com/en/tools/tailwind-color-palette-sync): Generate theme.extend.colors for tailwind.config.ts from HEX colors, with WCAG contrast levels and optional dark mode. - [URL Safety Checker](https://elysiatools.com/en/tools/url-safety-checker): Detect phishing and fraud signals in a URL by deep structural analysis — punycode/IDN homograph attacks (mixed Latin/Cyrillic), embedded credentials (user:pass@host trick), high-risk TLDs, double-encoding and control-character smuggling, subdomain brand deception, and numeric/IP host obfuscation. Static analysis only, no network. Complements the URL Validator (which does basic protocol/IP checks). - [AGEX Passphrase Strength Checker](https://elysiatools.com/en/tools/agex-passphrase-strength-checker): Evaluate a passphrase for AGEX file bundles and recommend the most suitable protection profile ## Samples - [Web Image Processing Python Samples](https://elysiatools.com/en/samples/web-image-processing-python): Web Python image processing examples using PIL/Pillow including reading, saving, resizing, and format conversion - [Network Security and SSL/TLS Configuration](https://elysiatools.com/en/samples/network-security): Comprehensive network security examples including SSL/TLS configuration, firewall rules, VPN setup, and network scanning protection - [Android Image Processing Java Samples](https://elysiatools.com/en/samples/android-image-processing-java): Android Java image processing examples including reading/saving images, scaling, and format conversion - [Android Image Processing Kotlin Samples](https://elysiatools.com/en/samples/android-image-processing-kotlin): Android Kotlin image processing examples including reading/saving images, scaling, and format conversion ## Related content - [API Request Replay, Snippet, and Runtime Debugging Tools](https://elysiatools.com/en/hubs/api-request-replay-and-debugging): Turn broken HTTP calls into reproducible cases with cURL-to-code converters, webhook capture and replay, HMAC verification, response diffing, header audits, TLS inspection, and request-path debugging tools. - [Authentication, Password, and Token Security Tools](https://elysiatools.com/en/hubs/auth-token-security): Generate and validate passwords, review JWTs, compare password-hash workflows, and inspect auth-related security basics in one hub. - [Document Encryption, Redaction, and Field Security Tools](https://elysiatools.com/en/hubs/document-field-security-workflows): Compare PDF password protection, permission control, encrypted PDF export, CSV/XLSX field encryption, AES bundles, and document redaction tools in one security workflow hub. - [Audio Encoding and Format Conversion Tools](https://elysiatools.com/en/hubs/audio-convert): Compare audio format conversion, bitrate changes, sample-rate conversion, codec swaps, and export tools in one hub for delivery and archive workflows.