Input is parsed without making a network request; components and risky assumptions are separated.
89
Code & file security
HTTP Security Headers Auditor
Parses raw HTTP response headers locally and reports duplicates or gaps in CSP, Strict-Transport-Security, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, and framing protection. It sends no request and does not validate TLS, application code, or live redirect behavior.
✓ Free✓ No account✓ In-browser
QUICK ANSWER
What does this tool do?
Audit pasted response headers for CSP, HSTS, nosniff, referrer, and permissions policies.
APPLICATION AND DECISION GUIDE
HTTP Security Headers Auditor: method and usage
Parses raw HTTP response headers locally and reports duplicates or gaps in CSP, Strict-Transport-Security, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, and framing protection. It sends no request and does not validate TLS, application code, or live redirect behavior.
the URL, HTTP headers, cURL command, API definition, or web configuration requested by the tool Confirm the shape first with a small example containing no personal data.
normalized web configuration, a component inventory, and actionable review notes
Practical steps
- Paste raw headers from a response you are authorized to inspect.
- Run the local audit and review missing, duplicate, or risky values.
- Verify findings against the live HTTPS response, browser console, and application threat model.
comparison with the current standard and real server behavior in an authorized test environment
Code is not executed, and no finding does not prove the absence of vulnerabilities.
Suitable use cases
- Pre-release header checks
- Comparing CDN/proxy configurations
- Planning a CSP rollout
LEARN THE WORKFLOW
Guides for this tool
How to Security-Audit Open-Source Browser Tools
A practical checklist for validating privacy claims through source, dependencies, network requests, CSP, and history.
Read guide →Local Security Pre-Checks for .env, SQL, and Unix Permissions
Surface common configuration, query, and permission risks before release without exposing secrets.
Read guide →ABOUT THIS TOOL
Frequently asked questions
What input does HTTP Security Headers Auditor accept?+
the URL, HTTP headers, cURL command, API definition, or web configuration requested by the tool Paste raw headers from a response you are authorized to inspect.
What does HTTP Security Headers Auditor return?+
normalized web configuration, a component inventory, and actionable review notes Input is parsed without making a network request; components and risky assumptions are separated.
How should I validate HTTP Security Headers Auditor output?+
comparison with the current standard and real server behavior in an authorized test environment
Does HTTP Security Headers Auditor send or store input on a server?+
Tool input is processed in the active tab. Saving to the Workstation or transferring to another tool is a separate choice. Consider browser extensions and shared devices separately; the privacy page explains advertising and network connections.