HTTP Headers Analyzer
Paste response headers to grade security headers, caching and CORS, with fixes.
Get them with
curl -sI https://example.com, or DevTools → Network → a request → Headers → Response headers (raw).F
Security score 26/100
HTTP/2 200
12 headers parsed
Security
- Missing Content-Security-PolicyStart with: Content-Security-Policy: default-src 'self'; object-src 'none'; frame-ancestors 'self'; base-uri 'self'
- Missing X-Content-Type-Options: nosniffStops browsers from guessing (sniffing) content types.
- CORS: wildcard origin with credentialsBrowsers reject this combination; if your server echoes the Origin instead, any site can read authenticated responses.
- HSTS max-age is short (3600 s)Use at least 6 months (15552000), ideally a year (31536000).
- Missing Referrer-PolicyRecommended: Referrer-Policy: strict-origin-when-cross-origin
- Missing Permissions-Policye.g. Permissions-Policy: camera=(), microphone=(), geolocation=()
- Missing Cross-Origin-Opener-PolicyCross-Origin-Opener-Policy: same-origin isolates your window from popups.
- Server header reveals the version: “nginx/1.18.0 (Ubuntu)”Hide versions (nginx: server_tokens off).
- X-Powered-By reveals the stack: “Express”Remove it (Express: app.disable("x-powered-by")).
- Cookie “session” is missing Secure, SameSitesession=abc123; Path=/; HttpOnly
- Clickjacking protection is setX-Frame-Options: SAMEORIGIN
Caching, CORS & performance
- Cache-Control: public, max-age=600Cached for 600 seconds.
- Compressed with gzip
All headers
| server | nginx/1.18.0 (Ubuntu) |
|---|---|
| date | Sun, 18 Oct 2026 10:00:00 GMT |
| content-type | text/html; charset=utf-8 |
| x-powered-by | Express |
| strict-transport-security | max-age=3600 |
| x-frame-options | SAMEORIGIN |
| cache-control | public, max-age=600 |
| access-control-allow-origin | * |
| access-control-allow-credentials | true |
| set-cookie | session=abc123; Path=/; HttpOnly |
| content-encoding | gzip |
| vary | Accept-Encoding |