Softonic

HTTP Security Headers Checker

Review copied HTTP response headers without sending them to a scanning service. The checker validates eight useful configuration areas, distinguishes missing headers from weak values, and keeps raw headers in your browser. It does not fetch a URL, inspect the response body or prove that a site is secure.

How to review response headers

  1. 1

    Capture the final response

    Open the browser network panel or use a trusted HTTP client, follow redirects and copy the response headers for the page you want to review.

  2. 2

    Paste the raw header block

    Include one Name: value pair per line. A status line such as HTTP/2 200 is accepted but ignored.

  3. 3

    Read the semantic checks

    Pass, review and missing states reflect recognized values, not simple header presence.

  4. 4

    Test changes in context

    Roll out policies carefully and retest the real page because CSP, COEP and Permissions-Policy can block required features.

What the local grade does and does not mean

The score is a configuration checklist, not a vulnerability scan or certification. It awards two points for a recognized strong value, one for a value that needs review, and zero when the control is absent or invalid.

Checks included

Area Strong signal used by this checker Important limit
HSTS Positive max-age of at least 180 days plus includeSubDomains Only send HSTS over HTTPS; confirm every covered subdomain supports HTTPS
CSP An enforcing policy restricts script sources without *, 'unsafe-inline' or 'unsafe-eval' A useful CSP is application-specific and must be tested
Framing Enforcing CSP frame-ancestors, or legacy X-Frame-Options: DENY/SAMEORIGIN Supporting browsers give frame-ancestors precedence
MIME X-Content-Type-Options: nosniff Servers still need correct Content-Type values
Referrer A policy such as strict-origin-when-cross-origin or no-referrer Choose a policy that fits analytics and privacy needs
Browser features Permissions-Policy closes at least one feature with feature=() and contains no wildcard allowlist The checker cannot prove that every feature allowlist fits the application
Cross-origin isolation COOP: same-origin and recognized COEP values These headers can break popups or cross-origin resources

The legacy X-XSS-Protection filter is not awarded points. Current guidance favors CSP; a nonzero legacy value is shown as an advisory. Server banners such as Server and X-Powered-By are also advisory, not proof of a vulnerability.

The technical rules follow the OWASP HTTP Headers Cheat Sheet, W3C CSP Level 3 and RFC 6797. A pasted block cannot reveal whether the headers came from HTTPS, whether a certificate is valid, whether redirects changed the policy, or whether the browser received a different cached response.

Privacy and funnel storage

Parsing and scoring run in this browser. Raw headers never become our servers properties and are never placed in the URL. In funnel mode, a random identifier points to a sessionStorage record that expires 30 minutes after creation; revisiting the record does not renew it. At most three current records are retained. Browser storage failures stop the funnel rather than sending the headers elsewhere.

Frequently Asked Questions

No. This tool does not contact the target site. Copy the final response headers from developer tools or a trusted HTTP client and paste those lines.

Presence is not enough. For example, HSTS with max-age=0 disables HSTS, and X-Content-Type-Options only recognizes the nosniff value.

No. The grade covers a narrow header checklist. It does not test application code, authentication, TLS configuration, dependencies or server vulnerabilities.

Content-Security-Policy-Report-Only collects reports but does not enforce restrictions. It is useful for rollout, but it is not an active protection by itself.

CSP frame-ancestors is the modern control and takes precedence in supporting browsers. X-Frame-Options can remain as a compatible fallback for older clients.

The browser filter is deprecated and can introduce problems. Modern guidance recommends a well-designed CSP and commonly omits the header or sets it to 0.

Not automatically. Cross-origin isolation enables specific capabilities but may block integrations, popups or resources. Review application requirements before deployment.

No. Analysis stays in the browser. In funnel mode the raw block is temporarily stored only in sessionStorage under an opaque identifier with a fixed 30-minute lifetime.

Related Tools

Breadcrumb Schema Generator

Generate valid BreadcrumbList JSON-LD for any page hierarchy. Produces schema.org markup ready to paste into your site head.

Backlink Anchor Text Analyzer

Paste backlinks, CSV rows, URL | anchor pairs or plain anchor lines to count repeated anchor text and export Anchor Text,Count,Share CSV.

Broken Link Checker

Crawl a single page (or a small sitemap) and flag every broken link by HTTP status. Fast check with redirect chain detection.

Word Frequency Counter

Find the most repeated words in any text with counts and density percentages. Useful for editing, SEO checks and content audits.

Canonical Tag Generator

Generate a valid rel=canonical link tag. Includes HTTP Link header equivalent and common mistakes to avoid.

Canonical URL Checker

Check the canonical URL Google sees for any page. Detects HTML link tag, HTTP Link header, conflicts and redirect chains.