Security Headers Explainer

Paste a response header block and read its security posture header by header — present, missing or weak, each verdict citing its spec.

0 bytes uploaded

This page reads only the text you paste. 0 bytes uploaded · nothing stored between visits

There is no field for a URL on this page, and no request is made. A page served from one origin cannot read another origin's response headers, so this tool reads only the block you paste. Fetching a URL would need a server to make the request for you. This page has none, so it asks for the headers instead.

Response header block0 characters · 0 lines

Drop a .txt file here to read it on this device.

The share link carries the block as pasted — it holds no hidden value.

present: —
missing: —
weak: —
notes: —

Show

Declared security headers and the posture of this block
Header	Posture	Value in this block	Findings
Content-Security-Policy	—	—	—
Strict-Transport-Security	—	—	—
X-Frame-Options	—	—	—
X-Content-Type-Options	—	—	—
Referrer-Policy	—	—	—
Permissions-Policy	—	—	—
Cross-Origin-Opener-Policy	—	—	—
Cross-Origin-Embedder-Policy	—	—	—
Cross-Origin-Resource-Policy	—	—	—
Set-Cookie	—	—	—
Reported for context when the block carries one, never graded: X-XSS-Protection, Expect-CT, Feature-Policy, Public-Key-Pins, Server, X-Powered-By, Access-Control-Allow-Origin.

Set-Cookie

This block sets no cookie.

The attributes this table checks on each line: Secure · HttpOnly · SameSite · Domain · Path · __Host- prefix · __Secure- prefix

Hidden values

Set-Cookie, Authorization, Proxy-Authorization and Cookie values are hidden until you reveal them, and the report you copy or download keeps them hidden.

Header lines whose values this page keeps hidden by default

No Set-Cookie, Authorization, Proxy-Authorization or Cookie line in this block.

This page grades ten headers and reports seven more for context. Present means the field is in the block and every rule checked here passes. Missing means the field is not in the block. Weak means a cited clause says it does not do what its presence suggests. Invalid means the value does not parse under its own syntax, and it is counted with weak. Set-Cookie is reported as informational when the response sets no cookie.

This page reports posture only. Depth lives on the pages above.

Press ? for shortcuts

Do it offline:$ curl -sS -o /dev/null -D - https://example.com

How to use it

Collect the headers: a browser's network inspector copies them, and so does a terminal dump of the response section.
Paste the block. A status line may ride along, names may be lower case, fields may repeat — all of it is reported rather than tidied away.
Read the counts strip, then the table: each declared field carries its posture beside the value that earned it, and cookies get their own attribute table.
Open a row for the finding in full — the wording, the specification section behind it, and a link to whichever page takes that field further.

A response header block is the `Name: value` lines a server returns ahead of the body. Paste one and every field in the declared set gets a row: present, missing or weak, with the clause each verdict comes from. No address is fetched, because a static page cannot read another origin's response. The bytes read are the bytes you paste, and none of them leave the device.

How it works

Splitting happens at the first colon, so a value holding colons of its own stays whole. Surrounding spaces come off the value and never off the name, and a space wedged before the colon is reported rather than repaired. A line starting with a space or a tab is a deprecated fold, joined to the field above with one space. Repeated fields keep both lines in the order pasted.

Five postures do the work, all five printed beside the table. A field is missing when the block lacks it, present when every checked clause holds, weak when a cited clause says it does less than its presence suggests, invalid when the value will not parse, informational when it is reported for context and never graded.

The absence of an address box is the design. Reading another site's response means issuing a cross-origin request for fields no browser exposes to script, so paste is the whole input surface.

Examples

HTTP/1.1 200 OK
Date: Mon, 17 Aug 2026 10:15:00 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 4096
Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
Content-Security-Policy: default-src 'self'; frame-ancestors 'none'; base-uri 'self'
X-Frame-Options: DENY
X-Content-Type-Options: nosniff
Referrer-Policy: strict-origin-when-cross-origin
Permissions-Policy: geolocation=(), camera=()
Cross-Origin-Opener-Policy: same-origin
Cross-Origin-Resource-Policy: same-origin
Vary: Accept-Encoding
Vary: Origin
Set-Cookie: session=demo-value; Path=/; Secure; HttpOnly; SameSite=Lax
Set-Cookie: theme=dark; Path=/; Secure; SameSite=Lax
Server: example-server

9 present · 1 missing · 0 weak · 4 notes
Content-Security-Policy · present · default-src 'self'; frame-ancestors 'none'; base-uri 'self'
Strict-Transport-Security · present · max-age=63072000; includeSubDomains; preload
X-Frame-Options · present · DENY
X-Content-Type-Options · present · nosniff
Referrer-Policy · present · strict-origin-when-cross-origin
Permissions-Policy · present · geolocation=(), camera=()
Cross-Origin-Opener-Policy · present · same-origin
Cross-Origin-Embedder-Policy · missing · (not in this block)
Cross-Origin-Resource-Policy · present · same-origin
Set-Cookie · present · 58 characters, hidden · 40 characters, hidden
Server · informational · example-server
cookie session (line 15) · present · Path=/; Secure; HttpOnly; SameSite=Lax
cookie theme (line 16) · present · Path=/; Secure; SameSite=Lax

Both cookie values sit behind a mask until Reveal is pressed, while their attributes are analysed in the open. Server carries no verdict, and the repeated Vary stays two lines.

HTTP/1.1 403 Forbidden
Content-Type: text/plain
Link: <https://example.test/main.css>; rel=preload;
  as=style
this line has no colon at all
Set-Cookie: sid=zz; SameSite=None

0 present · 9 missing · 1 weak · 13 notes
Line 1: `HTTP/1.1 403 Forbidden` was read as the status line (RFC 9112 § 4), so it is kept out of the field list below.
Line 4: this line starts with whitespace, so it continues `Link` from line 3. RFC 9112 § 5.2 deprecates that folding and says to replace it with one space, which is how the two lines were joined.
Line 5: `this line has no colon at all` has no colon, so it is not a field line (RFC 9110 § 5.1). It was skipped and the rest of the block was still read.
cookie sid (line 6) · weak · SameSite=None
`sid` has no Secure attribute, so a user agent will also send it over an unsecured channel (RFC 6265bis, The Secure Attribute).
`sid` has no HttpOnly attribute, so script running in the page can read it through document.cookie (RFC 6265bis, The HttpOnly Attribute). Cookies a page's own script must read are set this way on purpose.
`sid` is SameSite=None without Secure. A cookie that asks to travel on cross-site requests must also be Secure, and one that is not is rejected outright (RFC 6265bis, The SameSite Attribute).

One bad line costs one line: the fold is joined and flagged, the colonless line is skipped, and the fields around them are still graded. The cookie's third finding is why nothing stores it.

HTTP/1.1 200 OK
strict-transport-security: max-age=300
x-frame-options: ALLOW-FROM https://example.test
referrer-policy: unsafe-url

0 present · 6 missing · 3 weak · 10 notes
Strict-Transport-Security · weak · max-age=300
max-age is 300 seconds. RFC 6797 sets no minimum, so the only published number to compare against is the preload list's submission requirement of 31,536,000 seconds (HSTS preload list, Submission requirements); this value is below it.
includeSubDomains is not set, so this policy applies to this host name only and not to its subdomains (RFC 6797, § 6.1.2 The includeSubDomains Directive). The directive is optional.
X-Frame-Options · weak · ALLOW-FROM https://example.test
The value uses ALLOW-FROM, defined in RFC 7034 § 2.1 Syntax and left out of the HTML Standard's processing rules, where only DENY and SAMEORIGIN are read. Naming one permitted origin is done with the Content-Security-Policy frame-ancestors directive instead.
Referrer-Policy · weak · unsafe-url
The policy in force is `unsafe-url`, which sends the full URL, path and query included, to every origin this document links to or fetches from (Referrer Policy, Referrer policies).

Lower-case names read exactly like capitalised ones. The 300-second lifetime is not called a failure: the one published number compared against is the preload submission requirement, quoted rather than replaced by a threshold of our own.

Every example on this page is executed against the same engine that powers the tool, on every build.

Gotchas worth knowing

Repeated cookies stay repeated

Repeated field lines may be combined into one comma-separated value; a cookie line may not, because commas sit inside expiry dates. Each cookie keeps its own row and its own line number.

max-age=0 is an instruction, not a mistake

A zero lifetime tells the user agent to forget the host it already knows — the documented way to switch the field off. The report names that effect rather than calling the number wrong.

An empty allow list is a lockdown

`geolocation=()` grants the feature to nobody — the strongest thing that field can say — so it is never called a shortfall. The empty parenthesis pair denies every origin.

A `__Host-` name is a promise with conditions

That prefix is honoured only when the cookie is marked Secure, carries no Domain attribute and uses a path of exactly `/`. Break one of the three and the cookie is discarded outright.

Common errors

There is nothing to analyse yet: the box is empty. Paste a response header block — the `Name: value` lines a response carries, with or without its status line.: The empty state still lists the declared set and its rules, so the page reads before anything is pasted.
No field lines were found in the 2 non-blank lines pasted. A field line is `Name: value` (RFC 9110 § 5.1); a status line or a response body on its own is not enough.: Copying a body, or only the first line, leaves nothing to read. The count of what arrived is quoted so the paste can be checked.
The paste is 70,000 characters and this page reads at most 65,536, so nothing was parsed. Paste the header section on its own — the lines before the first blank line of the response.: Limit and actual are both printed, so the overshoot is visible. A header section that large is usually a whole response.
Line 3: `this line has no colon at all` has no colon, so it is not a field line (RFC 9110 § 5.1). It was skipped and the rest of the block was still read.: A stray line is skipped with its number quoted, never silently dropped and never fatal — the surrounding fields are still graded.
Line 2: there is whitespace between `X-Frame-Options` and the colon. RFC 9110 § 5.1 does not allow it, so this line was not read as a field; the rest of the block was.: Whitespace ahead of the colon is not a formatting quirk — a real recipient rejects it too, so the line is reported, not trimmed.

FAQ

Why is there no field for my URL?

Because there is no server here to fetch it with, and scripts cannot read another origin's response fields — an address box would promise work this page is unable to do. Paste the block and the same verdicts appear.

What does "weak" mean here?

That the field is present and a quoted clause says it achieves less than its presence implies — an obsolete token, a policy that only monitors, a lifetime under the one published threshold. Every weak row names the section it argues from.

Are my Set-Cookie and Authorization values sent anywhere?

No. Nothing is transmitted from this page at all. Those values stay masked until you reveal one, they are left out of any share link by construction with the omission counted on screen, and a credential-shaped paste is never kept for a later visit.

Keyboard shortcuts

⌘/Ctrl + Enter: Analyze the pasted block
f: Move to the report filter
j: Next header row
k: Previous header row
Enter: Open the selected row
Esc: Close the open row
r: Reveal or hide the focused hidden value
⌘/Ctrl + C: Copy the report
⌘/Ctrl + Shift + C: Copy the report (force)
? or ⌘/Ctrl + /: Keyboard shortcuts

Nothing you paste here leaves this tab. State only ever travels in links you explicitly create.

Last reviewed: 2026-08-17