HTTP header analyser

Paste the output of curl -sI https://example.com (or curl -v, or Copy response headers in the browser’s network panel). The tool reads every response in the paste — redirects included — and analyses the last one. It never fetches anything: browsers block cross-origin reads of most headers, so pasting is the only way to see the real thing.

Grade — points for the headers that matter, out of 100: Strict-Transport-Security (20), Content-Security-Policy (25), framing protection via frame-ancestors or X-Frame-Options (15), X-Content-Type-Options: nosniff (10), Referrer-Policy (10), Permissions-Policy (10), and the cross-origin isolation headers COOP, COEP, and CORP (3 each). Weak values score less, and version-revealing Server/X-Powered-By headers and insecure cookies cost points. A+ ≥ 90, A ≥ 75, B ≥ 60, C ≥ 45, D ≥ 30, E ≥ 15.
Content-Security-Policy — each directive is listed and checked. 'unsafe-inline' in script-src (without a nonce or hash), 'unsafe-eval', wildcards, data: scripts, and plain http: sources are flagged. Missing object-src 'none', base-uri, and frame-ancestors are noted, because default-src does not cover the last two. script-src falls back to default-src when absent, as browsers do.
Cookies — every Set-Cookie is checked for Secure, HttpOnly, and SameSite. It also checks the Host- and Secure- prefix rules, and flags SameSite=None without Secure, which browsers reject.
Caching — Cache-Control, Expires, ETag, Last-Modified, Age, and Vary are explained, including the difference between no-cache (revalidate every time) and no-store (never store).
CORS — Access-Control-Allow-Origin with credentials, wildcard rules, and a missing Vary: Origin when the allowed origin is reflected.

The CSP builder tab assembles a policy from checkboxes and source lists, starting from a strict default-src 'self' baseline. Roll a new policy out as Content-Security-Policy-Report-Only first and watch the reports before enforcing it.

Share link copies a URL that opens this tool exactly as configured. ?raw= carries pasted headers for Analyse headers; the CSP builder’s choices are packed into ?s=. Values of Cookie, Set-Cookie, Authorization, and API-key headers are replaced with [redacted] in links. For example: headers/?raw=Content-Type%3A%20text%2Fhtml.

Sharing