← ALL TOOLS
// RECON & INTEL · SERVER

HTTP Header Analyser

Grade a site's security headers A to F: HSTS, CSP, framing, sniffing, referrer, permissions, COOP and cookies.

RECON · SERVER-SIDE · RATE LIMIT 30/MIN

Rate limited: 10 runs in a burst, 30 per minute. Results are never stored. Too long to share as a link.

HISTORY

Your last 5 runs appear here for 7 days, on this device only.

RESULT

Fill in the form and run the tool; the result appears here.

HTTP Header Analyser fetches a URL once and grades the security-relevant response headers it returns, covering HSTS, Content-Security-Policy, framing protection, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, Cross-Origin-Opener-Policy, CORS, cookie flags and version disclosure, with a score out of 100 and an overall A to F grade.

How to read the result

Each check is marked pass, warn or fail with a short detail line saying what was found. A pass scores the check's full weight, a warn half; 90 or more is an A, 75 a B, 60 a C, 40 a D and anything lower an F. Over HTTPS, a certificate that is not trusted or not valid for the host caps the grade at C. The Final URL and Redirect rows show where the request ended up; the grade covers only the response it stopped at.

A single missing header rarely fails a site outright; the grade reflects the combined defence-in-depth these headers provide against clickjacking, MIME sniffing, downgrade and content-injection attacks.

Defender tips

  • Ship an explicit Content-Security-Policy rather than none; even a starting policy that only restricts framing and script sources closes real attack paths.
  • Turn on HSTS with a meaningful max-age once every subdomain serves HTTPS, and consider preload only after you are certain no subdomain will ever need plain HTTP.
  • Strip version-revealing Server and X-Powered-By headers; they cost attackers nothing to read and give away exactly which exploits to try first.

FAQ

Why does my grade differ from another header scanner?

Grading weights differ between tools and none of them are a standard; use the per-check detail, not just the letter grade, to decide what to fix first.

Does it follow redirects?

Yes, up to three redirects on the same host (for example from HTTP to HTTPS). A redirect to a different host is shown but not followed, and the grade then covers the redirect response itself, so test the destination URL directly.

Do I need HTTPS for a good grade?

Effectively yes. HSTS only means something over HTTPS, so on a plain HTTP response that check can score half at best, and browsers ignore the header there anyway.

// RELATED FINDING Missing security headers: impact, fix and references in the Findings Explorer