Softonic

Security Header Analyzer

Step 1 / 3
Next

Paste the raw HTTP response headers from any site and this analyzer flags what is missing or weak. It checks the headers that actually harden a site (Content-Security-Policy, Strict-Transport-Security, X-Content-Type-Options, X-Frame-Options, Referrer-Policy and Permissions-Policy) and points out headers like Server or X-Powered-By that leak version details. Every finding is tagged high, medium or low, so you know exactly what to fix first.

How the header audit works

  1. 1

    Grab your response headers

    Run `curl -I https://example.com`, or copy the Response Headers from the Network tab of your browser's developer tools.

  2. 2

    Paste them in

    Drop the header block into the box, one `Name: value` pair per line.

  3. 3

    Read the prioritized findings

    Each header is checked and any gap is tagged high, medium or low, with the exact directive to add.

  4. 4

    Harden and re-check

    Add the missing headers to your server config, reload, then paste the new response to confirm the gaps are closed.

Headers that move the needle

Header What it blocks Minimum recommended value
Content-Security-Policy XSS, clickjacking, mixed content default-src 'self'; object-src 'none'; frame-ancestors 'none'
Strict-Transport-Security SSL stripping, cookie leaks over HTTP max-age=31536000; includeSubDomains; preload
X-Frame-Options Clickjacking in legacy browsers DENY (or rely on CSP frame-ancestors)
X-Content-Type-Options MIME sniffing of user uploads nosniff
Referrer-Policy Leaking full URLs to third parties strict-origin-when-cross-origin
Permissions-Policy Camera/mic/geolocation on untrusted embeds camera=(), microphone=(), geolocation=()

What this analyzer flags

Paste your headers and it checks each of these, tagging every gap by priority:

  • Missing Strict-Transport-Security (high), or present but without includeSubDomains (medium), which leaves subdomains open to downgrade.
  • Missing Content-Security-Policy (high), or a CSP that still allows 'unsafe-inline' (medium), which undoes much of its value.
  • X-Content-Type-Options not set to nosniff (low), so browsers may MIME-sniff responses.
  • Missing X-Frame-Options (medium), unless a CSP frame-ancestors directive is already doing the job.
  • Missing Referrer-Policy or Permissions-Policy (low): full URLs leak to third parties and powerful browser features stay open.
  • Server or X-Powered-By present (low): these advertise your stack and version, so strip them to reduce fingerprinting.

Rollout tip

Deploy CSP in report-only mode first (Content-Security-Policy-Report-Only) and wire up a report endpoint. Let it run for a week of real traffic before switching to enforcement: you will discover third-party scripts you had forgotten about.

Frequently Asked Questions

Paste the full HTTP response headers, one Name: value per line. The quickest source is curl -I https://example.com, or the Response Headers section under any request in your browser’s Network tab.

No. It only reads the HTTP response headers you paste. A CSP delivered through a <meta http-equiv> tag applies to that one document only and is weaker than the real header, so send the header version.

No. Every modern browser has removed the XSS auditor, so the header offers no protection and can occasionally introduce its own issues. A solid Content-Security-Policy replaces it.

A CDN such as Cloudflare can strip or rewrite headers (notably Server, and optionally CSP via Transform Rules). Compare the origin directly with curl -I against the public URL to see exactly what the edge is changing.

Related Tools

Page Speed Insights

Enter any URL and open a free speed audit in Google PageSpeed Insights, GTmetrix or WebPageTest to see Core Web Vitals and Lighthouse scores.

External Links Extractor

Paste raw HTML, optionally set a base URL, and get a clean de-duplicated list of every external http/https link the code contains for link audits and SEO reviews.

Link Shortener Decoder

Expand bit.ly, t.co, tinyurl and other short links. See every redirect hop, status code and the final destination before you click.

Internal Links Extractor

Extract all internal links from a URL or pasted HTML with anchor text, rel attributes and nofollow status for SEO audits.

Meta Description Length Checker

Measure a meta description in characters and estimated pixels, compare editorial ranges, and inspect illustrative desktop and mobile previews.

Metadata Extractor

Extract page metadata from any URL: title, meta description, Open Graph, Twitter cards, canonical URL and JSON-LD structured data.

Tool available in other languages