✅ Security Headers Checklist
Paste a raw HTTP response (or just the header lines) and get a pass / warn / fail scorecard against key security headers, with a short explanation for each. Entirely client-side.
This checks presence and reasonable configuration against a fixed, opinionated ruleset — it's a quick
sanity check, not a full security audit. Some "warn" results are legitimately fine depending on your
application (e.g. a site with no cookies doesn't need
Strict-Transport-Security as urgently
as one handling logins).
1. Response headers
Paste headers one per line (Name: value). A leading request/status line, if present, is ignored.