HackproofHacks
Free tool · Headers

HTTP Security Header Analyzer

Scan any URL’s HTTP security headers in seconds. This free analyzer fetches the headers your site actually serves, deep-lints your Content-Security-Policy, audits your cookies, traces redirects and grades everything A+ to F, then gives you the exact attack each weakness enables and copy-paste fixes for your web server. A faster, more actionable, privacy-first alternative to securityheaders.com and Mozilla Observatory.

Enter a full URL or a domain, we’ll add https:// and follow redirects. You can target a specific path (e.g. /login).

How this works

When you run a scan, the tool sends a request to your URL and follows redirects (up to five hops), then reads the response headers a browser would end up trusting. It evaluates each security header, HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, the cross-origin isolation headers, CORS and cookie flags, and parses your Content-Security-Policy directive by directive to catch weaknesses like unsafe-inline or wildcard sources. The findings roll up into a 0–100 score and an A+ to F grade, and every gap comes with the attack it enables plus the exact header to add. We never store, log, or publish the URLs you scan.

An HTTP header analyzer that hands you the fix

Most HTTP header analyzers stop at a grade. You learn your site is missing a Content-Security-Policy or an HSTS header, and then you’re on your own to figure out what to write and where to put it. This tool closes that gap: for every missing or weak header it gives you the precise attack the weakness enables, XSS, clickjacking, SSL-stripping, session theft, and a copy-paste fix for your exact web server, whether that’s Nginx, Apache, Caddy, a Cloudflare Worker or Express. Run a scan, read the report, paste the config, ship.

Enter any URL, homepage, login page or API endpoint, and it fetches the live response headers, traces the redirect chain so you can confirm HTTP upgrades cleanly to HTTPS, and grades the result A+ to F with a transparent 0–100 score. Then it tells you which security headers are present, which are missing, and which are technically set but too weak to help.

A real Content-Security-Policy linter

A CSP header isn’t protection on its own, a policy riddled with unsafe-inline, unsafe-eval or wildcard sources blocks almost nothing. So instead of just checking that the header exists, this analyzer parses your Content-Security-Policy directive by directive: it flags unsafe-inline and unsafe-eval, wildcard and bare-scheme script sources, data: URIs, a missing object-src or base-uri, and the absence of frame-ancestors. It also detects when your policy is still in Report-Only mode, monitored but not actually enforced.

Cookies, cross-origin isolation and information leaks

Beyond the headline headers, it audits every Set-Cookie for the Secure, HttpOnly and SameSite flags and the __Host-/__Secure- prefixes, checks the cross-origin isolation headers (COOP, COEP, CORP) and common CORS misconfigurations, and flags information-disclosure headers like Server and X-Powered-By that hand attackers your software versions on a plate.

A privacy-first securityheaders.com & Observatory alternative

If you’ve used securityheaders.com or Mozilla Observatory, this covers the same core job and goes further on the two things that actually save you time: actionable fixes tailored to your server, and privacy. It runs on Cloudflare’s edge for fast results, and it doesn’t store, log, or publish the URLs you check, there’s no public archive of your scans. It’s built and maintained by a professional penetration-testing team, for developers, sysadmins and security engineers who want the answer and the fix in one place.

Headers are the surface, want the full picture?

Security headers are one layer. If you want your whole application, auth, APIs, business logic and configuration, assessed by experts, talk to our penetration-testing team.

Get a professional review

HTTP header analyzer, frequently asked questions

What is an HTTP header analyzer?

An HTTP header analyzer is an online tool that fetches the response headers a web page actually serves and grades how well they protect visitors. It checks the security headers browsers rely on, Strict-Transport-Security (HSTS), Content-Security-Policy (CSP), X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, the cross-origin isolation headers and cookie flags, then reports which are missing or misconfigured, why each one matters, and exactly how to fix it. This one follows redirects, deep-lints your CSP, audits your cookies, and hands you copy-paste configuration for Nginx, Apache, Caddy, Cloudflare and Express.

How is this better than securityheaders.com or Mozilla Observatory?

It does everything those tools do, fetch the headers, grade A+ to F, list what’s missing, and adds the parts they leave out. For every finding it gives you the concrete attack the weakness enables and a copy-paste fix for your exact web server (Nginx, Apache, Caddy, Cloudflare Workers or Express), so you don’t have to translate generic advice into config. It runs a full Content-Security-Policy linter that flags unsafe-inline, unsafe-eval, wildcard sources and missing directives, audits every Set-Cookie for Secure/HttpOnly/SameSite, traces the redirect chain, and checks HSTS preload eligibility. And unlike securityheaders.com, it never stores or publishes the URLs you scan.

Which security headers does it check?

Strict-Transport-Security (HSTS) including max-age, includeSubDomains and preload; Content-Security-Policy and CSP-Report-Only with a full directive-by-directive lint; X-Frame-Options and CSP frame-ancestors for clickjacking; X-Content-Type-Options (nosniff); Referrer-Policy; Permissions-Policy; the cross-origin isolation trio (COOP, COEP, CORP); CORS misconfigurations; cookie security flags on every Set-Cookie; and information-disclosure headers such as Server and X-Powered-By that leak your software versions.

What is a good grade for HTTP security headers?

Aim for an A or A+. That means HSTS is set with a long max-age and includeSubDomains, an enforcing Content-Security-Policy with no unsafe-inline/unsafe-eval or wildcards, clickjacking protection via frame-ancestors or X-Frame-Options, nosniff, a sensible Referrer-Policy and Permissions-Policy, and session cookies marked Secure + HttpOnly + SameSite. A B or C usually means the basics are present but the CSP is weak or a key header is missing; a D or F means visitors are exposed to XSS, clickjacking or protocol-downgrade attacks.

Why does Content-Security-Policy matter so much?

CSP is the single most important security header because it’s the main defence against cross-site scripting (XSS), consistently one of the most common and damaging web vulnerabilities. A strong policy tells the browser exactly which scripts, styles and other resources are allowed to load, so even if an attacker injects markup, the browser refuses to execute it. The catch is that a policy with unsafe-inline, unsafe-eval or wildcard sources provides little real protection, which is why this tool lints each directive rather than just checking the header exists.

What does X-Frame-Options / frame-ancestors protect against?

Clickjacking. Without framing protection, an attacker can load your page inside a hidden or transparent iframe on their own site and trick a logged-in user into clicking buttons they can’t see, confirming a payment, changing a setting, or granting a permission. Setting X-Frame-Options: DENY (or the modern CSP frame-ancestors directive) tells browsers not to render your page inside other sites’ frames.

Does it follow redirects and check HTTP to HTTPS upgrades?

Yes. The analyzer traces the full redirect chain (up to five hops) and shows each hop, so you can confirm that plain-HTTP requests are upgraded to HTTPS and that there are no open or unexpected redirects. It analyses the headers on the final response, the ones a real browser would end up trusting.

Can I analyze a specific page or just the homepage?

Any URL, including a specific path such as https://example.com/login or an API endpoint. Security headers can differ between routes, a login page or admin panel may need a stricter policy than a marketing page, so checking the exact URL that matters is the right approach.

Is the HTTP header analyzer free?

Yes, completely free with no account, sign-up or API key. Enter a URL, pass the quick bot check, and you get the full report instantly.

Do you store the URLs I analyze?

No. Scans are processed in real time and the report is returned to your browser only, we don’t store, log, or publish the URLs you check. That’s a deliberate difference from tools that keep a public, searchable archive of every scan.

Why are my security headers missing even though my site is on HTTPS?

HTTPS encrypts the connection, but it doesn’t add security headers, those are response headers your web server or application has to send explicitly. Many hosts and frameworks ship with none of them by default, which is why a perfectly valid HTTPS site can still score an F. The fix is to add the headers in your server or CDN config; this tool generates that config for you.

Will adding these headers break my site?

Most are safe to add immediately, X-Content-Type-Options, X-Frame-Options, Referrer-Policy and a sensible HSTS policy rarely cause problems. The one to roll out carefully is Content-Security-Policy: a strict policy can block legitimate inline scripts or third-party widgets, so deploy it in Content-Security-Policy-Report-Only first, watch the violation reports, then switch to enforcing. The tool flags when you’re still in report-only mode.

This is one check in a full website security audit, see the practical checklist.