DevTools Hub

Search tools

Search for a developer tool

Network Security

Security Headers Analyzer

Analyze CSP, HSTS, X-Frame-Options, Referrer-Policy, and Permissions-Policy — score, recommendations, and explanations.

Part of the Network Security Toolkit

Paste headers as copied from your browser's Network tab or curl -I output — one Name: value per line.

Security score

77

Good

Recommendations
  • script-src allows 'unsafe-inline' — inline scripts (including ones injected by an attacker) can run, which defeats most of CSP's XSS protection.
  • max-age is 15,768,000 seconds — under the commonly recommended one year (31536000 seconds).
  • includeSubDomains isn't set — subdomains aren't covered, leaving them open to the same downgrade risk this header exists to prevent.
  • "origin-when-cross-origin" sends more of the URL than necessary to cross-origin destinations — consider strict-origin-when-cross-origin instead.
Explanation
Content-Security-Policy
14/20

default-src 'self'; script-src 'self' 'unsafe-inline'

Content-Security-Policy tells the browser which sources scripts, styles, images, and other resources may be loaded from — the primary defense against cross-site scripting (XSS), since injected script from an unauthorized source simply won't run.

Strict-Transport-Security
11/20

max-age=15768000

Strict-Transport-Security (HSTS) tells the browser to only ever connect to this site over HTTPS for a set duration, even if the user types or clicks an http:// link — it closes the window where a downgrade or SSL-stripping attack could intercept a plaintext first request.

X-Frame-Options
20/20

SAMEORIGIN

X-Frame-Options controls whether this page can be loaded inside a <frame> or <iframe> on another site — the classic defense against clickjacking, where a malicious page frames yours invisibly and tricks a user into clicking something they can't actually see.

Referrer-Policy
12/20

origin-when-cross-origin

Referrer-Policy controls how much of this page's URL is sent in the Referer header when a user clicks a link to another site — URLs can contain session tokens, internal paths, or other sensitive data that shouldn't leak to third parties.

Permissions-Policy
20/20

geolocation=(self), camera=()

Permissions-Policy controls which powerful browser features — camera, microphone, geolocation, payment APIs, and more — this page (and anything embedded in it) is allowed to use, restricting third-party iframes from invoking capabilities they don't need.

What this does

Analyzes raw HTTP response headers — pasted from your browser's Network tab or curl -I output — for five of the highest-impact browser security headers: Content-Security-Policy, Strict-Transport-Security, X-Frame-Options, Referrer-Policy, and Permissions-Policy. Each is scored individually based on both presence and the actual quality of its configuration — a header that's present but configured permissively (an unsafe-inline CSP, a one-hour HSTS max-age) scores lower than a genuinely strict one, not just a flat present/absent check.

How the score is calculated

Each of the five headers is worth an equal share of the total score. A header that's missing entirely scores 0 for that share (except Referrer-Policy, since modern browsers already apply a reasonably safe default policy on their own even with no header set at all). A header that's present gets full credit only when it's configured strictly — the specific criteria for each header are listed under "Explanation" once you run an analysis, along with why that configuration matters.

A genuinely important interaction: CSP and X-Frame-Options

A Content-Security-Policy with a frame-ancestors directive does the same job as X-Frame-Options — controlling who can iframe this page — and modern browsers prefer it. This tool checks for that specifically: a missing X-Frame-Options header isn't penalized if frame-ancestors is already present in the CSP, since adding a redundant header on top wouldn't improve security.

FAQ

Where do I actually get these headers to paste in?

Open your browser's DevTools, go to the Network tab, reload the page, click the main document request, and copy the response headers shown there — or run "curl -I https://example.com" from a terminal, which prints them directly.

Why does this only analyze five headers when there are more security headers than that?

These five — CSP, HSTS, X-Frame-Options, Referrer-Policy, and Permissions-Policy — cover the highest-impact, most commonly misconfigured browser security controls. Others exist (X-Content-Type-Options, Cross-Origin-Opener-Policy, and more), but these five are where most real-world configuration mistakes concentrate.

Is a 100 score a guarantee this site is secure?

No — these headers reduce specific classes of client-side attack (XSS, clickjacking, protocol downgrade, referrer leakage, misuse of browser APIs). A perfect score here says nothing about server-side vulnerabilities, authentication flaws, or dozens of other security concerns entirely outside what HTTP response headers can control.

Why is X-Frame-Options sometimes marked good even when it's missing?

If a Content-Security-Policy is present with a frame-ancestors directive, that directive fully replaces X-Frame-Options's job and is what modern browsers actually prefer — so a missing X-Frame-Options isn't penalized when frame-ancestors is already doing the same work.

Does this tool fetch headers from a live URL?

No — it only analyzes headers you paste in, entirely in your browser. It never makes a network request on your behalf.

Try it yourself

For what each header actually does and how they fit together, see HTTP Security Headers Explained.

Related tools

CIDR Calculator

Calculate network address, broadcast address, host range, and subnet mask from IPv4 CIDR notation.

SPF Record Parser

Parse an SPF TXT record — mechanisms, qualifiers, includes, DNS lookup count, and common mistakes.