Why can’t I just enter a URL?

Browsers can’t read another site’s full response headers because of the same-origin policy, so fetching them directly would require routing through a third-party server. This tool stays fully local, so you fetch the headers yourself with curl -sI or DevTools and paste them — which also works for intranet, staging and logged-in pages.

How is the grade calculated?

It starts at 100 and deducts points for missing key headers (HSTS, CSP, X-Content-Type-Options, clickjacking protection, Referrer-Policy, Permissions-Policy) and for risky settings such as 'unsafe-inline' scripts or a CORS wildcard with credentials. 85 or more is an A; A+ needs all six key headers, no critical issues and at least 95. The grade is guidance — real risk depends on your site and threat model.

How should I use a CSP nonce?

The server must generate a fresh random nonce (at least 128 bits) for every response and put it both in the CSP header as 'nonce-…' and on every tag. With 'strict-dynamic', scripts loaded by those trusted scripts are allowed too, so you don’t need a domain allowlist. The nonce generated in the builder is only an example and must never be hard-coded.

What are the limits of a CSP meta tag?

doesn’t support frame-ancestors, report-uri, report-to or sandbox, can’t be Report-Only, and only applies to content after it in the page. The builder drops those directives and tells you; use the HTTP header whenever you can.

🦺

🦺Security Headers Checker - CSP, HSTS & Cookie Grade

Find out whether your site’s security headers are right with a single paste. Run curl -sI https://your-domain in a terminal, or copy the main document’s response headers from your browser’s DevTools Network panel, and paste them in. You get an A+ to F grade and a check of every header: HSTS max-age, includeSubDomains and preload eligibility; every CSP directive, flagging 'unsafe-inline', 'unsafe-eval', overly broad sources like * or https:, keywords missing their quotes, missing object-src / base-uri / frame-ancestors, and Report-Only policies that enforce nothing; X-Content-Type-Options; X-Frame-Options versus frame-ancestors precedence; Referrer-Policy; Permissions-Policy syntax and sensitive features; COOP / COEP / CORP cross-origin isolation; each Set-Cookie’s Secure, HttpOnly and SameSite flags and __Host- / __Secure- prefix rules; dangerous CORS wildcard-plus-credentials combinations; version numbers leaked by Server or X-Powered-By; caching on logged-in pages; and obsolete headers such as X-XSS-Protection, HPKP and Expect-CT. Each finding explains why it matters and gives a fix you can copy. A CSP builder lets you start from a strict (nonce + strict-dynamic) or same-origin template, edit directives and sources, generate a random nonce, hash inline scripts or styles with SHA-256/384/512, and output the HTTP header, a meta tag and nginx, Apache and Caddy snippets, with live checks of the policy. No network requests are made — all analysis happens locally.

Free · No sign-up · Runs in your browserLast updated: 2026-10-26

Loading tool...

How to use HTTP Security Headers Checker

1Copy response headers with curl -sI or DevTools and paste them in
2Review the grade and each check, then apply the suggested fixes on your server
3Switch to the CSP builder to edit a policy and copy the header, meta tag or nginx / Apache / Caddy config

FAQ

Why can’t I just enter a URL?: Browsers can’t read another site’s full response headers because of the same-origin policy, so fetching them directly would require routing through a third-party server. This tool stays fully local, so you fetch the headers yourself with curl -sI or DevTools and paste them — which also works for intranet, staging and logged-in pages.
How is the grade calculated?: It starts at 100 and deducts points for missing key headers (HSTS, CSP, X-Content-Type-Options, clickjacking protection, Referrer-Policy, Permissions-Policy) and for risky settings such as 'unsafe-inline' scripts or a CORS wildcard with credentials. 85 or more is an A; A+ needs all six key headers, no critical issues and at least 95. The grade is guidance — real risk depends on your site and threat model.
How should I use a CSP nonce?: The server must generate a fresh random nonce (at least 128 bits) for every response and put it both in the CSP header as 'nonce-…' and on every <script nonce="…"> tag. With 'strict-dynamic', scripts loaded by those trusted scripts are allowed too, so you don’t need a domain allowlist. The nonce generated in the builder is only an example and must never be hard-coded.
What are the limits of a CSP meta tag?: <meta http-equiv="Content-Security-Policy"> doesn’t support frame-ancestors, report-uri, report-to or sandbox, can’t be Report-Only, and only applies to content after it in the page. The builder drops those directives and tells you; use the HTTP header whenever you can.