# Security Headers Checker - CSP, HSTS & Cookie Grade

> Paste raw HTTP response headers to get an A+ to F grade with checks for HSTS, CSP, X-Frame-Options, cookies, CORS and more, plus fixes and a CSP builder.

- URL: https://qilingtools.com/en/security-headers
- Category: Developer Tools (https://qilingtools.com/en/dev)
- Tags: [Privacy & Security](https://qilingtools.com/en/tags/privacy), [Developer](https://qilingtools.com/en/tags/dev), [Network & HTTP](https://qilingtools.com/en/tags/network)
- Last updated: 2026-10-26
- Price: Free, no sign-up
- Privacy: Runs locally in the browser; files are never uploaded

Find out whether your site’s security headers are right with a single paste. Run curl -sI https://your-domain in a terminal, or copy the main document’s response headers from your browser’s DevTools Network panel, and paste them in. You get an A+ to F grade and a check of every header: HSTS max-age, includeSubDomains and preload eligibility; every CSP directive, flagging 'unsafe-inline', 'unsafe-eval', overly broad sources like * or https:, keywords missing their quotes, missing object-src / base-uri / frame-ancestors, and Report-Only policies that enforce nothing; X-Content-Type-Options; X-Frame-Options versus frame-ancestors precedence; Referrer-Policy; Permissions-Policy syntax and sensitive features; COOP / COEP / CORP cross-origin isolation; each Set-Cookie’s Secure, HttpOnly and SameSite flags and __Host- / __Secure- prefix rules; dangerous CORS wildcard-plus-credentials combinations; version numbers leaked by Server or X-Powered-By; caching on logged-in pages; and obsolete headers such as X-XSS-Protection, HPKP and Expect-CT. Each finding explains why it matters and gives a fix you can copy. A CSP builder lets you start from a strict (nonce + strict-dynamic) or same-origin template, edit directives and sources, generate a random nonce, hash inline scripts or styles with SHA-256/384/512, and output the HTTP header, a meta tag and nginx, Apache and Caddy snippets, with live checks of the policy. No network requests are made — all analysis happens locally.

## How to use

1. Copy response headers with curl -sI or DevTools and paste them in
2. Review the grade and each check, then apply the suggested fixes on your server
3. Switch to the CSP builder to edit a policy and copy the header, meta tag or nginx / Apache / Caddy config

## Features

- A+ to F grade with per-finding deductions
- HSTS max-age and preload eligibility checks
- Directive-by-directive CSP analysis: unsafe-inline / eval, wildcards, missing directives
- Cookie Secure, HttpOnly, SameSite and __Host- prefix checks
- CORS, Permissions-Policy and COOP / COEP / CORP analysis
- Version leakage and obsolete header warnings
- CSP builder with nonce generator, inline script hashing and keyword toggles
- Outputs HTTP header, meta tag and nginx / Apache / Caddy snippets

## FAQ

### Why can’t I just enter a URL?

Browsers can’t read another site’s full response headers because of the same-origin policy, so fetching them directly would require routing through a third-party server. This tool stays fully local, so you fetch the headers yourself with curl -sI or DevTools and paste them — which also works for intranet, staging and logged-in pages.

### How is the grade calculated?

It starts at 100 and deducts points for missing key headers (HSTS, CSP, X-Content-Type-Options, clickjacking protection, Referrer-Policy, Permissions-Policy) and for risky settings such as 'unsafe-inline' scripts or a CORS wildcard with credentials. 85 or more is an A; A+ needs all six key headers, no critical issues and at least 95. The grade is guidance — real risk depends on your site and threat model.

### How should I use a CSP nonce?

The server must generate a fresh random nonce (at least 128 bits) for every response and put it both in the CSP header as 'nonce-…' and on every <script nonce="…"> tag. With 'strict-dynamic', scripts loaded by those trusted scripts are allowed too, so you don’t need a domain allowlist. The nonce generated in the builder is only an example and must never be hard-coded.

### What are the limits of a CSP meta tag?

<meta http-equiv="Content-Security-Policy"> doesn’t support frame-ancestors, report-uri, report-to or sandbox, can’t be Report-Only, and only applies to content after it in the page. The builder drops those directives and tells you; use the HTTP header whenever you can.

## Related tools

- [JSON Formatter](https://qilingtools.com/en/json): Free online JSON formatter: beautify or minify, validate with the exact line and column of any error, browse a collapsible tree, sort keys and escape strings.
- [Base64 Encode/Decode](https://qilingtools.com/en/base64): Free online Base64 encoder and decoder: UTF-8 safe, optional URL-safe variant, convert text to Base64 and back in real time. Processed locally, never uploaded.
- [URL Encode/Decode](https://qilingtools.com/en/url-encode): Free online URL encoder and decoder with encodeURIComponent and encodeURI modes. Escapes Chinese, spaces and special characters. Real-time and local, no upload.
- [JWT Decoder](https://qilingtools.com/en/jwt): Free online JWT decoder: decode the header and payload of a JSON Web Token, show expiry and issued-at times, all locally without uploading the token.
- [Timestamp Converter](https://qilingtools.com/en/timestamp): Free online Unix timestamp converter: convert timestamps and dates, auto-detect seconds or milliseconds, and show local, UTC, ISO 8601 and relative time.
- [Hash / Checksum](https://qilingtools.com/en/hash): Free online hash calculator: SHA-1, SHA-256, SHA-384 and SHA-512 of text or any file through the browser crypto API. Files never leave your device.
- [UUID Generator](https://qilingtools.com/en/uuid): Free online UUID generator: create RFC 4122 UUID v4 in bulk with a cryptographic RNG. Options for uppercase, no hyphens and braces, with one-click copy.
- [Base Converter](https://qilingtools.com/en/base-convert): Free online number base converter: convert between binary, octal, decimal, hexadecimal and any base 2–36. Uses BigInt for huge integers, computed locally.