{{ summaryTitle }} {{ summaryValue }} {{ summaryLine }} {{ badge.label }}{{ badge.value }}
Paste or load one response capture. Redact cookie values, private hosts, and reporting endpoints before sharing exports.
{{ sourceStatus }}
Parsing notes:
  • {{ warning }}
Use a short audit label; this tool does not fetch the target.
Choose the response type represented by the pasted fields.
Select the transport and hop context before interpreting HSTS and cookies.
Keep on for complete audit context; turn off for a shorter scored-control ledger.
{{ params.include_info ? 'Included' : 'Hidden' }}
StatusControlPriorityObserved evidenceRecommended actionCopy
{{ statusLabel(row.status) }}{{ row.control }}{{ row.priority }}{{ row.observed }} — {{ row.evidence }}{{ row.recommendation }}
OrderPriorityControlFixTarget exampleCopy
{{ index + 1 }}{{ row.priority }}{{ row.control }}{{ row.recommendation }}{{ row.target }}
No Fail or Warn rows are queued for this capture.
HeaderOccurrencesAudit roleValueCopy
{{ row.header }}{{ row.occurrences }}{{ row.role }}{{ row.value }}
Hypertext Transfer Protocol (HTTP) Header Checker Check a public URL’s HTTP headers across redirects and review security, cache behavior, browser state and cross-origin exposure.
CSP Header Policy Checker Check a Content-Security-Policy header for risky script sources and missing baseline directives, with reporting and rollout blockers explained.
SameSite Cookie Policy Checker Check Set-Cookie headers for SameSite delivery and find Secure or HttpOnly gaps, prefix mistakes, partitioned-cookie issues and flow breakage.
CSP Header Generator Draft a Content Security Policy header with nonce, hash, or allowlist script trust plus report-only rollout checks and blocker warnings.

Browsers use response headers to enforce boundaries before they render a document, run scripts, expose a response across origins, or store a cookie. Those controls can reduce downgrade, injection, clickjacking, data-leakage, and caching risks, but they work only on the responses where they are actually delivered.

One capture represents one route and one moment. A final HTTPS document, redirect, API response, static asset, signed-in page, and error page may pass through different application, proxy, or content-delivery rules. A secure-looking homepage cannot prove that account pages or edge-generated errors carry the same policies.

Policy area Representative evidence Important boundary
Transport Strict-Transport-Security Browsers ignore HSTS learned over plain HTTP.
Executable content and framing CSP, frame-ancestors, and nosniff A report-only CSP records violations but does not enforce them.
Privacy and browser features Referrer-Policy and Permissions-Policy The safest value depends on legitimate analytics and feature needs.
Session and storage Cookie attributes and Cache-Control A public asset and a personalized account response need different storage decisions.
Cross-origin exposure CORS, COOP, COEP, and CORP Stricter isolation can break popups, embeds, and third-party resources.

Header presence alone is not enough. A CSP containing broad wildcards or unsafe script tokens can offer little useful restriction. SameSite=None without Secure is not a sound cross-site cookie setup. A wildcard CORS response cannot be combined with credential sharing, and an HSTS policy should not cover subdomains until each one is HTTPS-ready.

Security headers are defense in depth, not proof that an application is secure. They do not find authorization flaws, vulnerable dependencies, injection bugs in server code, or exposed secrets. Their value is to make browser policy explicit and to expose missing, weak, contradictory, or obsolete controls for a specific response.

How to Use This Tool:

Start with one captured response and describe its real context before judging any header value.

  1. Paste or load one response header block in Response headers. Redact cookie values, private hosts, tokens, trace identifiers, and reporting endpoints first.
  2. Give the capture a short Target label that identifies the route, environment, state, or response variant without adding secret details.
  3. Choose the matching Response profile: browser document, sensitive app page, JSON or API response, or static asset response.
  4. Select whether the evidence came from a final HTTPS response, plain HTTP response, or redirect hop. This changes HSTS and cookie interpretation.
  5. Review failing and warning rows in Header findings, then follow Remediation plan in priority order. Parsing notes must be resolved before the score is trusted.
  6. Capture and compare the corresponding redirect, success, error, signed-in, and edge responses after remediation.

Interpreting Results:

The overall state follows the most serious finding: any Fail produces Fail, otherwise any Warn produces Review, and a capture with only Pass or Info rows produces Pass. The numerical score and grade help order work, but a bonus can lift the score above 100 and does not turn the result into a compliance certificate.

  • Prioritize the actual failing or warning control, not the grade in isolation.
  • Informational findings carry no penalty. Hiding them shortens the ledger without changing the score, grade, counts, or remediation order.
  • Area posture shows where weighted loss is concentrated. An area at 100 may simply contain no scored controls for the selected context.
  • Verify proposed CSP, HSTS, CORS, cookie, and isolation changes in staging; overly strict values can break legitimate application behavior.

Technical Details:

The parser accepts an optional HTTP status line followed by Name: value fields. Folded continuation lines are joined with a warning. Repeated cookies remain separate; other repeated fields are combined and flagged because clients or intermediaries may merge or override them.

Rule Core

Thirteen checks form the posture model. Context changes applicability and severity, so the selected response profile and transport are part of the evidence rather than labels added after scoring.

Control Key pass, warning, or failure rule
HSTS Final HTTPS needs a numeric max-age. Less than 15,552,000 seconds warns; less than 31,536,000 seconds also warns; missing includeSubDomains warns. A valid one-year policy with subdomain coverage passes. Plain HTTP cannot establish HSTS.
CSP Missing enforced CSP fails documents but warns for an API. Report-only warns. Unsafe script tokens or wildcard executable sources fail; missing default-src, object-src 'none', or base-uri warns.
MIME and framing X-Content-Type-Options passes only as nosniff. Framing passes with CSP frame-ancestors or recognized DENY/SAMEORIGIN; obsolete ALLOW-FROM fails.
Referrer and features Strong referrer values pass; unsafe-url, origin-when-cross-origin, and no-referrer-when-downgrade fail. Permissions-Policy warns on wildcard access for reviewed powerful features.
Isolation Missing isolation is contextual; COOP: unsafe-none warns. A good COOP value plus COEP or CORP earns one bonus point.
Cookies HTTPS cookies missing Secure, or SameSite=None without Secure, fail. Missing HttpOnly or SameSite warns when no failure condition applies.
Caching Sensitive responses need no-store or a private policy; missing or looser storage rules warn. Non-sensitive profiles keep cache decisions informational unless an explicit suitable policy is present.
CORS Wildcard origin with credentials fails. Wildcard without credentials warns outside an API profile; a named origin passes with a reminder to emit Vary: Origin when selected dynamically.
Exposure and reporting Common server or framework banners warn. HPKP fails and other obsolete fields warn. A linked enforced-CSP reporting endpoint earns one bonus point.

Formula Core

Each Fail loses its full priority weight, each Warn loses 45% of that weight, and Pass or Info loses nothing. The weight scale is Critical 28, High 20, Medium 12, Low 6, and Informational 0. Passed HSTS preload syntax can add two points; passed isolation and reporting conditions can add one point each.

S=round( clamp(100−∑inPi+∑jmBj,0,105) )

For finding i, the penalty is its priority weight for Fail, 0.45 times that weight for Warn, and zero otherwise. Bonuses apply only when their finding passes.

GradeBoundary
A+100 or higher and no failed findings
A90 or higher
B80 to 89
C70 to 79
D60 to 69
E50 to 59
FBelow 50

Area posture uses only findings with positive weights. Retained posture is the rounded percentage of possible weight left after penalties within Transport, Browser policy, Privacy, Isolation, Session, or Exposure. An area with no positive-weight checks returns 100.

Privacy and Accuracy Notes:

The pasted capture and local file are analyzed in the browser; the checker does not fetch the target. Exports can reproduce header values, including cookies and reporting destinations, so redact sensitive values before analysis and protect any downloaded evidence.

  • The rules intentionally inspect a practical subset of header syntax. Browser support, application behavior, policy interactions, and route-specific requirements still need testing.
  • The score is an advisory model defined for this checker, not an official standard, penetration test, or proof of compliance.
  • A header copied from developer tools or a proxy log can be stale or incomplete. Capture the final public response again after every remediation.

References: