↑↓ to move · Enter to open · Esc to close

Website Headers Analyzer

Use this website headers analyzer to check the final HTTP response from a public page. Review the findings and suggested changes before editing your server configuration.

This check runs on our server. The address you enter is used only for this check and is not stored.
Built and reviewed by · Updated

One page, up to 5 MB of HTML. Scripts do not run.

Tick the box to show you are not a robot, then press Analyze headers.

How to use the Website Headers Analyzer

  1. Enter a public page URL, including https://.
  2. Complete the robot check, then press Analyze headers.
  3. Read the grade and each finding. Test suggested header changes against the needs of your application before deploying them.

How the header grade works

The tool fetches one response from our server and follows up to three redirects. It grades the final response using an advisory rubric with 100 possible points: HSTS 15, CSP 20, content type protection 10, frame restrictions 10, referrer policy 5, permissions policy 5, opener policy 5, cache policy and validators 10, compression 5, version exposure 5, and cookie attributes 10.

HSTS is not scored on HTTP. Compression is not scored for bodies smaller than 1,024 bytes, and cookies are not scored when no Set-Cookie header is received. The score is earned points divided by applicable points, multiplied by 100 and rounded. Grades are A at 90 or more, B at 80, C at 70, D at 60, E at 50, and F below 50.

Examples of header findings

  • An enforced CSP with a restricting effective script policy earns 20 points. Explicit script directives override default-src. A present but broad policy earns 10; a report-only policy earns no CSP points.
  • Cache-Control: no-store earns the cache points without requiring an ETag. Cacheable responses can earn points from an explicit policy and a validator.
  • A session cookie with Secure, HttpOnly and SameSite=Lax passes the cookie check. SameSite=None requires Secure.

Read the finding before changing a header

A high grade does not prove that an application is secure. The checker does not test access control, SQL injection, business logic or the full meaning of a CSP. Its CSP check uses a small heuristic, and the presence of Permissions-Policy does not prove that each directive is correct.

Some choices depend on the application. A JavaScript-readable preference cookie may intentionally omit HttpOnly. A strict opener policy can affect sign-in or payment popups. HSTS includeSubDomains should be enabled only after every relevant subdomain supports HTTPS. The suggested values are starting points for testing, not settings applied to your site.

What is inspected and what is kept private

The report covers headers received by our server, including a CDN response when the CDN serves the request. Cookie names and attributes are shown, while cookie values are omitted. The target address and the results are not saved. For the raw header list, use HTTP Headers. Use SSL Certificate to inspect the TLS certificate.

Limitations

  • One public page is checked, with a 5 MB response limit and a 15-second request timeout.
  • The result reflects our server location and request. Browsers, logged-in users, other paths and other regions may receive different headers.
  • No JavaScript runs. Headers set on a later API request are outside this report.
  • The grade is a custom advisory score, not a security certification or an external vendor rating.

Frequently asked questions

What does the website header grade measure?

It measures the final response against the points rubric shown in the report. It covers selected security, cache, compression, banner and cookie checks, not the security of the whole application.

Why is my CSP present but only worth 10 points?

A broad policy, or one without a restricting default-src or script-src recognized by the heuristic, receives partial points. The tool is not a full CSP validator.

Does the analyzer show cookie values?

No. It shows cookie names and attributes such as Secure, HttpOnly and SameSite, while omitting their values.

Can I copy every suggested header unchanged?

Test each suggestion first. Resource loading, embedded pages, cross-site sign-in and JavaScript-readable cookies can require different settings.

Often used together with Website Headers Analyzer.

  • HTTP HeadersNetwork Tools

    Status, final URL, and response headers from one GET.

  • SSL CertificateNetwork Tools

    Subject, alternative names, issuer, validity, and key type for the certificate on port 443.

  • Redirect CheckerNetwork Tools

    Every redirect hop, with status, Location, and time, up to 10 hops.