Paste the response headers from a website and see how well protected it is. To check a domain without copying headers yourself, use the Domain Security Check.

HTTP security header analyzer. Paste-in only: grades the presence and configuration of the headers you supply. Browsers cannot read cross-origin response headers, so this tool does not fetch anything. The Domain Security Check retrieves them server-side.

Offline parser and weighted grader over pasted headers. No network access: the same-origin policy makes cross-origin response headers unreadable from a browser, and a no-cors opaque response exposes neither headers nor status. Scores Strict-Transport-Security and Content-Security-Policy at 20 each, X-Frame-Options, X-Content-Type-Options, Referrer-Policy and Permissions-Policy at 10 each, and X-XSS-Protection and Cache-Control at 5 each, for 90 possible, then maps the percentage to a letter grade. Cross-Origin-* isolation headers are not currently scored. For server-side retrieval see the Domain Security Check.