OneTaskBy Tim King · Updated
Security Headers Checker
HSTS, CSP, X-Frame-Options, nosniff and Referrer-Policy Checked From Pasted Response Headers
OneTask is free, with no sign-up, and built by one person.
If this tool saved you time, a coffee helps keep new ones coming.
How the Security Headers Checker works
This security headers checker reads the HTTP response headers you paste and marks each security header as OK, weak or missing, with a note on why it matters. It also flags headers that leak your software versions and cookies sent without Secure, HttpOnly or SameSite.
How to use the security headers checker
Get the headers with curl -sI https://example.com, or open the browser developer tools, pick the page
request on the Network tab and copy the response headers. Paste them in, one Name: value per line.
The status line and blank lines are skipped, and repeated headers such as Set-Cookie are checked one
by one.
The checker looks at the six headers every scanner expects: Strict-Transport-Security,
Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy and
Permissions-Policy. A short HSTS max-age, a policy that allows inline or eval scripts, an obsolete
framing value or a referrer policy that sends full URLs all count as weak. X-Frame-Options is not
needed when the CSP sets frame-ancestors.
Cross-origin isolation headers are shown as optional. A Server header with a version number,
X-Powered-By and similar headers are marked as leaks, because they tell attackers which known bugs
to try.
FAQ
Why doesn't the checker fetch the URL itself?
Browsers block pages from reading another site's response headers unless that site allows it through CORS, so a fetch from this page would fail for most sites. Pasting the headers also lets you check a staging server or an internal site that is not reachable from the internet.
Is a missing Referrer-Policy a real problem?
Modern browsers already default to strict-origin-when-cross-origin, so the risk is small. Setting the header still protects visitors on older browsers and makes the choice explicit, which is why scanners still mark it as missing.
What should I do about the weak and missing results?
Use the Security Headers Generator to write the missing headers for nginx, Apache, Netlify or Express, and the CSP Builder for a policy without unsafe-inline. Then paste the new response headers here again to confirm every row turns OK.
See also: all Security & Identifiers tools, Dev Utilities, Formatters & Validators, Data & Encoding, SEO, Accessibility, AI.
Related tools
Security Headers Generator
Generate HTTP security headers for nginx, Apache, Netlify and Express.
HTTP Header Inspector
Parse pasted HTTP headers, explain each one and audit security.
CSP Tester
Explain a CSP, flag weaknesses, and test whether a URL would load.
HSTS Preload Checker
Check a Strict-Transport-Security header against the HSTS preload rules.
CVSS Calculator
Score a vulnerability with CVSS 3.1 from metrics or a vector.