Paste raw HTTP response headers to check for missing security headers like CSP, HSTS, and X-Frame-Options.
Idiot Security Toolscurl -I https://yoursite.com in a terminal, or via your browser's Network tab (right-click a request → Copy Response Headers).HTTP security headers are instructions a web server sends back to the browser, telling it how to behave defensively when handling that site's content, things like restricting which scripts are allowed to run, preventing the page from being embedded elsewhere, and forcing encrypted connections. This HTTP Security Headers Analyzer lets you paste raw response headers, the kind you'd get from a command like curl -I or your browser's network inspector, and instantly see which commonly recommended security headers are present and which are missing.
We deliberately designed this tool around pasted header text rather than fetching a URL directly, and there's a specific, honest reason for that choice: browsers enforce cross-origin restrictions that prevent JavaScript on this page from freely reading another site's response headers directly, exactly the same kind of limitation described in our SSL/HTTPS Checker tool. Working from headers you've already retrieved yourself (via curl, your browser's developer tools, or any other means) sidesteps that restriction entirely while keeping the entire analysis genuinely client-side.
Strict-Transport-Security (HSTS) tells browsers to remember that your site should only ever be accessed over HTTPS, closing a window where an attacker on the same network could try to downgrade a visitor's connection to unencrypted HTTP. Content-Security-Policy (CSP) is one of the most powerful defenses against cross-site scripting attacks, letting you explicitly declare which sources of scripts, styles, and other resources a page is allowed to load, so injected malicious scripts from unauthorized sources simply won't execute. X-Frame-Options prevents your pages from being secretly embedded inside an invisible iframe on an attacker's site, a technique called clickjacking that tricks users into clicking something they didn't intend to.
X-Content-Type-Options with a value of "nosniff" stops browsers from trying to guess a file's type based on its content rather than trusting the declared Content-Type header, closing off a class of attacks that rely on that guessing behavior. Referrer-Policy controls how much information about the page a visitor came from gets leaked to the next site they navigate to, which matters for both privacy and preventing sensitive URLs from leaking through the referrer header. Permissions-Policy lets a site explicitly restrict which powerful browser features, like camera, microphone, or geolocation access, are allowed to be used at all, reducing the impact if a page is ever compromised by malicious injected content.
The simplest method is running curl -I https://yourdomain.com from a terminal, which prints just the response headers without downloading the full page body. Alternatively, open your browser's developer tools, go to the Network tab, reload the page, click on the main document request, and look for an option to copy the response headers directly.
Not every site needs every header in every situation, but each missing header from this list represents one less layer of defense-in-depth against a specific, well-understood class of attack. Treat the results here as a prioritized checklist for hardening your server configuration, typically implemented through your web server's configuration file, a reverse proxy, or middleware in your application framework, rather than something changeable through this client-side tool itself.
Browsers enforce cross-origin restrictions that prevent JavaScript on this page from directly reading another site's response headers. Pasting headers you've already retrieved yourself works around that limitation honestly.
Run curl -I https://yourdomain.com from a terminal, or use your browser's developer tools Network tab and copy the response headers for the main document request.
No. This checks for the presence of commonly recommended headers only. Security also depends heavily on how correctly each header's value is actually configured, not just whether it's present.
Typically in your web server's configuration file (Apache, Nginx), a reverse proxy, a CDN's edge configuration, or middleware within your application framework, not something this client-side analysis tool can change directly.
No, all parsing and analysis happens locally in your browser using JavaScript string matching against the pasted text.