# HTTP Security Headers Analyzer

> One page from jmrp.io, published as markdown. Index: https://jmrp.io/llms.txt

Canonical: https://jmrp.io/tools/http-headers-analyzer/
Language: en
Alternate: https://jmrp.io/es/tools/http-headers-analyzer/index.md
Updated: 2026-09-03
License: https://jmrp.io/license/
Category: security
Tags: http, headers, security, hsts, csp, analysis

Analyze HTTP response headers for security best practices. Get a security score, recommendations, and detailed analysis for each header.
Build-Date: 2026-09-06

Features:
- Analyzes 10 critical security headers
- Weighted score with A+ to F letter grade
- Detects information leakage headers
- Fetch from URL or paste headers manually
- All analysis runs in your browser

Questions answered:

**Which HTTP security headers does this tool check?**

It evaluates 10 critical headers including Content-Security-Policy, Strict-Transport-Security, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy and the three Cross-Origin policies. It also flags information leakage from "Server", "X-Powered-By" and "X-AspNet-Version" headers.

**How is the security score calculated?**

Each header carries a weight reflecting its impact, with Content-Security-Policy worth the most (25 points) and X-XSS-Protection the least (3 points). The weighted total maps to a letter grade from A+ (90-100) down to F (0-29).

**Why are some headers missing when I fetch them from a URL?**

Fetch asks this site's own proxy for the headers, and that proxy issues a HEAD request with its own User-Agent and no cookies. Headers a server only sends on GET, only to a signed-in session, or only after content negotiation will not appear, and if the site sits behind a CDN you see the edge's headers rather than the origin's. For an exact capture, paste the output of curl -sI or the response headers from browser DevTools.

**Is my data sent to a server when I analyze headers?**

The analysis never leaves your browser: whatever is in the text box is parsed, scored and graded on your own machine. The optional Fetch button is the exception, because a browser is not allowed to read another site's response headers — CORS forbids it — so the URL you submit goes to a small proxy on this domain, which requests the headers and hands them back. That proxy has its access log switched off, so the URL you inspect is never written beside your address, and the site being inspected sees this server rather than you. Paste headers instead of fetching and nothing is sent at all.

**Should I still set X-XSS-Protection?**

No. X-XSS-Protection is a legacy filter that modern browsers ignore or that can introduce vulnerabilities; the recommended value is "0" to disable it, and a strong Content-Security-Policy is the proper XSS defense.


---

**Interactive tool** — this page hosts the working application itself, not a description of one.

## What does this tool do?

Analyze your HTTP response headers for security best practices. The tool
evaluates 10 critical security headers, checks for information leakage, and
provides a weighted score with actionable recommendations. You can paste
headers manually or fetch them from a URL.

### Which headers are analyzed?

- **Content-Security-Policy** (25 pts) — XSS and injection prevention
- **Strict-Transport-Security** (15 pts) — HTTPS enforcement
- **X-Content-Type-Options** (10 pts) — MIME sniffing prevention
- **X-Frame-Options** (8 pts) — clickjacking protection
- **Referrer-Policy** (8 pts) — referrer information control
- **Permissions-Policy** (8 pts) — browser feature restrictions
- **Cross-Origin-Opener-Policy** (8 pts) — browsing context isolation
- **Cross-Origin-Resource-Policy** (8 pts) — resource loading control
- **Cross-Origin-Embedder-Policy** (7 pts) — embedding control
- **X-XSS-Protection** (3 pts) — legacy XSS filter (should be disabled)

Additionally, the tool checks for **information leakage** via `Server`, `X-Powered-By`, and `X-AspNet-Version` headers.

### Grading Scale

- **A+** (90-100) — Excellent security posture
- **A** (80-89) — Strong, minor improvements possible
- **B** (70-79) — Good, some headers missing
- **C** (50-69) — Fair, several important headers missing
- **D** (30-49) — Poor, major gaps
- **F** (0-29) — Critical, most headers missing

### How do I use it?

1. Enter a URL and click Fetch, or paste headers from browser DevTools / curl
2. Click Analyze to see the security score and recommendations
3. Fix missing headers in your server configuration and re-analyze

### Is my data private?

All analysis happens entirely in your browser: the headers in the text box are parsed, scored and graded on your own machine, and nothing about them is sent anywhere. The Fetch button is the exception. CORS stops a browser from reading another site's response headers, so the URL you submit goes to a small proxy on this domain that requests them for you. That proxy has its access log switched off, so the URL you inspect is never written beside your address, and the site being inspected sees this server rather than you. To keep even that request off the network, paste headers captured with `curl -sI` instead of using Fetch.

### Linux Command Reference

You can inspect HTTP headers from the terminal using these tools:

#### curl — Headers Only

```bash
curl -sI https://example.com
```

**Output — Response Headers**

```text
HTTP/2 200
date: Thu, 12 Feb 2026 07:37:48 GMT
content-type: text/html
cf-ray: 9cca6c3e7e52ddef-MAD
last-modified: Wed, 11 Feb 2026 23:52:30 GMT
accept-ranges: bytes
cf-cache-status: HIT
server: cloudflare
```

#### curl — Filter Security Headers

```bash
curl -sI https://jmrp.io | grep -iE '^(strict-transport|x-content-type|x-frame|referrer|cross-origin|permissions|content-security)'
```

**Output — Security Headers**

```text
strict-transport-security: max-age=63072000; includeSubDomains; preload
x-content-type-options: nosniff
x-frame-options: DENY
referrer-policy: strict-origin-when-cross-origin
cross-origin-embedder-policy: require-corp
cross-origin-opener-policy: same-origin
cross-origin-resource-policy: same-origin
content-security-policy: default-src 'self'; script-src 'self' ...
```

#### curl — Verbose (TLS + Headers)

```bash
curl -sv https://example.com -o /dev/null 2>&1 | grep '< '
```

**Verbose Output**

```text
< HTTP/2 200
< date: Thu, 12 Feb 2026 07:37:48 GMT
< content-type: text/html
< server: cloudflare
```

#### wget — Spider Mode

```bash
wget -S --spider https://example.com 2>&1 | grep '^\s'
```

**Output — wget Response Headers**

```text
HTTP/1.1 200 OK
Date: Thu, 12 Feb 2026 07:37:52 GMT
Content-Type: text/html
cf-cache-status: HIT
server: cloudflare
```

#### Check Specific Header

```bash
# Check if HSTS is present
curl -sI https://jmrp.io | grep -i strict-transport

# Check CSP policy
curl -sI https://jmrp.io | grep -i content-security-policy
```

**Output — Header Check**

```text
strict-transport-security: max-age=63072000; includeSubDomains; preload
content-security-policy: default-src 'self'; script-src 'self' ...
```

#### Compare Multiple Sites

```bash
for site in example.com jmrp.io github.com; do
  echo "=== $site ==="
  curl -sI "https://$site" | grep -ci '^\(strict-transport\|x-content-type\|x-frame\|referrer-policy\|permissions-policy\|content-security-policy\|cross-origin\)'
  echo "security headers found"
done
```

**Output — Headers Count**

```text
=== example.com ===
0 security headers found
=== jmrp.io ===
9 security headers found
=== github.com ===
5 security headers found
```

### Learn More

See [Implementing CSP in Nginx](https://jmrp.io/blog/003-implementing-content-security-policy-nginx/) for a detailed guide on configuring security headers.