Analyze HTTP response headers and security configuration.
Paste raw HTTP headers (one per line, format: Header-Name: value)
HTTP response headers are metadata sent by a web server along with the response body. They contain information about caching, content type, security policies, server software, and more. They are invisible to users but critical for security and performance.
Essential security headers include: Strict-Transport-Security (HSTS), Content-Security-Policy (CSP), X-Content-Type-Options, X-Frame-Options, Referrer-Policy, and Permissions-Policy. These protect against XSS, clickjacking, MIME sniffing, and other common attacks.
The grade is based on the presence of 6 key security headers. Each present header earns points. Grade A = all 6 present, Grade B = 5, Grade C = 4, Grade D = 2-3, Grade F = 0-1. The actual configuration quality is also considered for some headers.