Security Header Analyzer
Paste HTTP response headers and get a graded report on the security headers present and missing.
HTTP response headers are where a site tells the browser how to defend it. Missing ones are among the most common findings in any web assessment, partly because they are easy to overlook and partly because nothing breaks when they are absent — until something does.
How to use it
- Paste raw HTTP response headers.
- Press Analyze headers.
- Read which protective headers are present, which are missing, and why each one matters.
What to take away
Content-Security-Policy is the heavyweight
A good CSP turns many XSS bugs from exploitable into harmless by controlling what the browser is allowed to load and run. It is also the hardest to deploy without breaking a site.
Strict-Transport-Security closes the first-request gap
Without HSTS, a user who types the domain without https:// makes one plaintext request that an attacker on the network can hijack.
X-Frame-Options and frame-ancestors stop clickjacking
Without one of them, your page can be framed invisibly under someone else's. The Clickjacking Simulator shows exactly what that looks like.
Frequently asked questions
Which security headers actually matter most?
Content-Security-Policy, Strict-Transport-Security, and a framing control (X-Frame-Options or CSP frame-ancestors). X-XSS-Protection is obsolete and should be omitted rather than set.
Are missing security headers a real vulnerability?
On their own they are usually a low-severity finding, because they are defence in depth rather than a flaw. They matter because they decide whether a separate bug is exploitable or contained.
How do I see the headers for a site?
Open your browser devtools, go to the Network tab, reload, and click the first document request — or use curl -I on the command line.
Where this fits in the course
This security tool pairs with Path 11 — Web Security — see all 26 learning paths.
It runs entirely in your browser: nothing is uploaded, no account is needed, and it is free.
Related
- Clickjacking Simulator — An invisible iframe sits on top of a fake game button. See exactly how a real click lands on a hidden "delete account" button instead.
- Raw HTTP Request Builder — Build a raw HTTP request from method, path, headers, and body — see exactly what goes over the wire.
- CSRF Playground — A "bank" transfer endpoint trusts your cookie alone. Watch a malicious page forge a request on your behalf, then see a CSRF token stop it cold.
- Secure Code Review Toy — Paste a code snippet and get flagged patterns — eval, string-built SQL, hardcoded secrets. Not a real SAST tool, but trains the eye.