HTTP Headers & Security Inspector
Parse HTTP headers, audit critical security headers (HSTS, CSP, X-Frame-Options, CORS), and calculate a security grade. · Updated
HTTP header audits catch missing HSTS, weak CSP, clickjacking gaps, and dangerous CORS before they hit production. This inspector grades security headers entirely in your browser so production response dumps never leave your machine. Copy headers from DevTools Network → Response Headers, review the grade widget, then convert related curls with the companion cURL tool.
Common errors and fixes
No headers detected
Paste raw response headers from DevTools (one Name: value per line). Include the status line if available.
Low security grade
Add HSTS, CSP, X-Frame-Options (or frame-ancestors), X-Content-Type-Options: nosniff, and a strict Referrer-Policy.
CORS credentials with wildcard
Browsers reject Access-Control-Allow-Origin: * with credentials. Echo a specific origin instead.
Why it happens, with a live exampleHSTS ignored on HTTP
Strict-Transport-Security only applies over HTTPS. Serve the site on TLS before enabling preload.
FAQ
What security headers does this tool audit?
It checks Strict-Transport-Security (HSTS), Content-Security-Policy (CSP), X-Frame-Options (Clickjacking defense), X-Content-Type-Options (nosniff), Referrer-Policy, Permissions-Policy, and CORS wildcard configurations.
How can I copy headers from my browser DevTools?
Open DevTools (F12) → Network tab → Click any request → In the 'Headers' panel, copy 'Response Headers' and paste here.