Security Header Analyzer
Analyze HTTP security headers
About the Security Header Analyzer
HTTP security headers are a frontline defense against attacks like cross-site scripting and clickjacking, yet they are easy to forget to configure. Security Header Analyzer reviews a set of response headers, checks for the ones that matter, rates how complete your coverage is, and explains what each missing header would protect against.
It is built for a security or deployment review: paste the response headers from a site and instantly see whether Content-Security-Policy, Strict-Transport-Security, and the rest are present, with a score that summarizes your posture. Developers use it to harden a site before launch; auditors use it to document gaps with concrete recommendations.
Note that it analyzes headers you paste in — it does not fetch a URL for you — so you control exactly which response is being assessed.
How to Use the Security Header Analyzer
- Copy the response headers from your site (from your browser's network tab or a curl -I command).
- Paste them into the "HTTP Headers" box, one per line in Header-Name: value form.
- Click Analyze.
- Read the security score and the per-header results: which are present, their severity, and a recommendation for each, then Copy the summary.
Why Use ToolForge’s Security Header Analyzer
- It checks eight key security headers and assigns each a severity (from critical for Content-Security-Policy down to low), so you know which gaps to fix first.
- It produces a coverage score and a specific recommendation per header, turning a review into an actionable checklist.
- Because it analyzes headers you paste, you can assess any response — including staging environments or authenticated requests — that a URL-fetching scanner could not reach.
- Analysis is entirely client-side, so headers that may include sensitive values are never uploaded.
Frequently Asked Questions
Which security headers does it check?
It evaluates eight: Content-Security-Policy, Strict-Transport-Security, X-Frame-Options, X-Content-Type-Options, X-XSS-Protection, Referrer-Policy, Permissions-Policy, and Cache-Control — each tied to a specific protection such as preventing XSS, enforcing HTTPS, or blocking clickjacking.
Does this tool scan a website by URL?
No. It analyzes the headers you paste into it rather than fetching a site itself. That design lets you assess responses a public scanner cannot see — like internal environments or authenticated pages — but it means you need to supply the headers. To capture live headers from a URL, use an HTTP headers checker first.
How is the security score calculated?
The score reflects how many of the eight checked headers are present in what you pasted, expressed as a percentage. It is a quick coverage indicator; the per-header severity and recommendations tell you which missing headers carry the most risk.
Where do I find my site's response headers?
Open your browser's developer tools, go to the Network tab, reload the page, click the main document request, and read the Response Headers section. Alternatively, run curl -I https://yoursite.com from a terminal and copy the output.
