Security Headers Guide

The six HTTP headers that protect your visitors — explained plainly, graded instantly, with the fix for each.

👤 Your account

🔍 Header Analyzer

In any browser: open a website → press F12 → Network tab → reload → click the first request → copy the response headers and paste them here. The analysis runs entirely on this device. Or start with the sample.

📚 The headers that matter

Strict-Transport-Security (HSTS)Forces HTTPS for future visits, killing downgrade and cookie-stealing attacks on plain HTTP. Aim for max-age ≥ 31536000 with includeSubDomains.
Content-Security-Policy (CSP)The strongest XSS defence: whitelists where scripts, styles and images may load from. “unsafe-inline” largely defeats it for scripts.
X-Frame-Options / frame-ancestorsStops your pages being framed by attacker sites (clickjacking). DENY or SAMEORIGIN; CSP frame-ancestors is the modern spelling.
X-Content-Type-Options: nosniffPrevents browsers from MIME-sniffing a file into a different, executable type.
Referrer-PolicyControls how much of the URL leaks to other sites via the Referer header. strict-origin-when-cross-origin is the sane default.
Permissions-PolicySwitches off browser features your site doesn't need (camera, microphone, geolocation…) so a compromise can't use them.

Headers are server configuration, not magic: they only protect visitors to your site. As a visitor, your defences are updates, a modern browser and checking the padlock — see the SSL guide in the footer.

🗂 My Saved Analyses

One record per site you analyze, with its grade and fix list. Records live under your local account (or guest space) on this device — create, view, edit and delete them any time.

More free tools by Dinal Studios