Your files stay on your device

# Security headers checker

Check pasted response headers or a live URL for the common security headers and read each raw value, presence kept separate from quality.

Nothing checked yet
Paste response headers, or switch to Live URL to fetch them through the proxy.

Presence is not quality, so this checker never grades: a permissive Content-Security-Policy still shows as present, and a missing X-Frame-Options can be deliberate for a page that is meant to be framed. Read the raw value column, not just the present or missing flag. The live path follows no redirects (the proxy reports 3xx with a Location), and it cannot see headers added by anything between you and the origin, such as a CDN or a service worker.
Options

## More web & auth tools

- [HTTP header parser](/web/headers)
- [CSP evaluator & builder](/web/csp)
- [Cookie analyzer](/web/cookie)
[All web & auth tools](/web)

Was this tool useful?
YesNo

---

Canonical HTML: https://nutter.tools/web/security-headers-checker
Markdown version: https://nutter.tools/web/security-headers-checker.md
Plain-text version: https://nutter.tools/web/security-headers-checker.txt
Agent index: https://nutter.tools/llms.txt