# HTTP Security Header Analyser

> Paste response headers and get a security grade, with what is missing and why it matters.

HTTP security headers instruct the browser to enforce protections the server cannot apply alone. This analyser grades pasted response headers against eight of them — CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy and the two cross-origin policies — and flags headers that disclose your software versions.

**URL:** https://convertto.tech/t/http-header-analyser
**Category:** Developer Tools (https://convertto.tech/c/developer-tools)
**Privacy:** Runs entirely in the browser; no upload
**Cost:** Free, no sign-up
**Last updated:** 2026-08-01

## Key facts

- **Privacy:** Runs entirely in your browser — nothing is uploaded
- **Cost:** Free, unlimited, no sign-up

## How to use

1. Enter or paste your response headers.
2. The result appears immediately — copy or download it.

## FAQ

### Which header matters most?

Content-Security-Policy, by a wide margin — it is the only one that meaningfully limits cross-site scripting, still the most common serious web vulnerability. Deploy it in report-only mode first, since a strict policy usually breaks something on the first attempt.

## Related tools

- [Content Security Policy Generator](https://convertto.tech/t/csp-generator): Build a CSP header from common presets, with each directive explained.
- [HTTP Header Checker](https://convertto.tech/t/http-header-checker): Follow every redirect, grade the security headers and read the cookie and caching settings.
- [API Request Builder](https://convertto.tech/t/api-request-builder): Build an HTTP request visually and get it as curl, fetch, axios, Python, Go or PHP code.
- [Edge Case Test String Generator](https://convertto.tech/t/edge-case-string-generator): Generate the strings that break input handling — Unicode, RTL, emoji, injection patterns and boundary lengths.
- [HTTP Status Code Reference](https://convertto.tech/t/http-status-codes): Look up what any HTTP status code means and when to use it.
- [Prompt Injection Sanitizer](https://convertto.tech/t/prompt-injection-sanitizer): Strip invisible carriers, neutralise instruction-like markup and fence untrusted content before you paste it into a prompt.
- [Bcrypt Hash Generator](https://convertto.tech/t/bcrypt-hash-generator): Hash a password with bcrypt at a configurable cost factor — the right way to store passwords.
- [Email Header Analyzer](https://convertto.tech/t/email-header-analyzer): Paste raw email headers to map the delivery path, time every hop and read the SPF, DKIM and DMARC results the receiving server recorded.