Tool
What the Security Headers Analyzer does
Security Headers Analyzer: checks Grade, Score and Report from Response headers (paste from curl -I or DevTools). Example: the sample loaded on the page gives grade D.
Grade, Score and Report, derived from Response headers (paste from curl -I or DevTools). Each change is reflected immediately, which suits quick what-if comparisons.
Length buys far more protection than complexity rules ever did. The Security Headers Analyzer exists to take that particular chore off your hands.
Nothing is transmitted or logged, which is the only acceptable design for a tool that handles credentials.
If you want to check the arithmetic, the field table, the method and a worked example are further down.
What do the Security Headers Analyzer fields mean?
The Security Headers Analyzer uses 1 input. Every box starts with a working value, so there is a real result on screen before you touch anything.
| Field | What to enter | Default |
|---|---|---|
| Response headers (paste from curl -I or DevTools) | paste or type any amount of text | HTTP/2 200 server: nginx content-type: text/html; charset=utf-8 strict-transport-security: max-age=31536000; includeSubDomains x-content-type-options: nosniff x-frame-options: SAMEORIGIN referrer-policy: strict-origin-when-cross-origin set-cookie: session=abc; Path=/; HttpOnly x-powered-by: PHP/8.2 |
How does the Security Headers Analyzer work?
Each output is derived from the inputs above in a single pass; there is no hidden state carried between runs, so the same inputs always give the same check.
The tool refuses to guess: if a value is missing or impossible, it says so.
Worked example
These are the values the Security Headers Analyzer loads by default, and the result it produces from them. The figures are the tool’s live defaults and its live output, so you can reproduce them exactly.
| Response headers (paste from curl -I or DevTools) | HTTP/2 200 server: nginx content-type: text/html; charset… |
|---|
| Grade | D |
|---|---|
| Score | 50 |
| Report | Strict-Transport-Security: OK - max-age 31536000, includeSubDomains Content-Security-Policy: Missing - Missing: the… |
How to use it
- Paste your content into Response headers (paste from curl -I or DevTools).
- Watch the results panel as you type: it recalculates on every keystroke.
- The panel reports Grade, Score and Report.
- The link encodes your inputs, so saving it is enough to reproduce the result later.
What this tool does not do
- Anything generated here is only as safe as where you store it afterwards.
- Anything generated here is only as safe as wherever you store it afterwards.
- Assumptions built into the method are stated above, but they are still assumptions.
Frequently asked questions
Response headers (paste from curl -I or DevTools), nothing else. Defaults are loaded for all of them, letting you treat it as a what-if tool rather than a data-entry form.
With the values loaded when the page opens, grade comes out as D. That number tracks the inputs, so a small edit shows its sensitivity immediately.
Not at all: the whole thing runs offline once the page has loaded, which tells you nothing is being sent.
Free, and there is no upsell. The whole tool is the free version.
The logic is straightforward and testable; the worked example above uses the tool’s own defaults so you can verify it yourself.