Security headers checker

Paste the headers of an HTTP response. Each security header is checked against its specification, and the result is graded from A to F.

Nothing is fetched: the checker reads only what you paste, so it works for staging and internal hosts too. Each finding links its source.

These tools run entirely in your browser. Nothing you paste or drop is uploaded, stored, or sent to analytics.