Free Tool · Client-Side Only

Security Headers
Analyzer.

Paste raw HTTP response headers and instantly get a security grade, detailed findings for every header, and copy-paste fix recommendations.

📋

Paste HTTP Response Headers

Frequently asked

Which security headers matter most?
Six carry most of the weight: Content-Security-Policy (stops most XSS and injection), Strict-Transport-Security (forces HTTPS), X-Content-Type-Options: nosniff, X-Frame-Options or CSP frame-ancestors (clickjacking), Referrer-Policy, and Permissions-Policy. A site with all six correctly set grades A here; a missing CSP alone caps you at B.
How do I get my site's response headers to paste in?
From a terminal: curl -sI https://example.com prints just the headers. In Chrome or Firefox: open DevTools → Network, reload, click the first request and copy the Response Headers block. Paste either output as-is — the analyzer ignores the status line and non-security headers.
Are the headers I paste sent to a server?
No. Parsing and grading run entirely in your browser; nothing you paste leaves the page. That is also why the tool works on internal or staging hosts that are not reachable from the internet.
What is the difference between X-Frame-Options and frame-ancestors?
Both prevent clickjacking by controlling who may embed the page in a frame. X-Frame-Options is the older header with two useful values (DENY, SAMEORIGIN). CSP's frame-ancestors directive supersedes it and lets you allow specific origins. Modern browsers prefer frame-ancestors when both are present; ship both for older clients.

Related free tools

CSP Builder

Build a Content-Security-Policy header directive by directive, with a live preview and per-setting analysis.

Cookie Analyzer

Check Secure, HttpOnly, SameSite and Domain flags on every Set-Cookie header.

TLS Config Grader

Grade a TLS configuration for protocol versions, cipher suites and known weaknesses.

Read next

HTTP security headers: the complete guide

What each header does, which ones matter in 2026, and copy-paste values for nginx, Apache, Express and Cloudflare.
Headers drift on every deploy

Check these headers on
every release, automatically.

One paste tells you where a site stands today. AquilaX DAST re-checks security headers, TLS and cookies on every deploy, flags regressions, and opens a fix PR against your config.

Scan my app for free → How AquilaX DAST works

Free plan is permanent · unlimited scans · GitHub, GitLab, Bitbucket & Azure DevOps