Paste an HTTP response’s headers and get a grade, the risks and how to fix them, all in your browser.
HTTP security headers instruct the browser to defend against common attacks such as XSS, clickjacking, MIME sniffing and referrer leakage. This analyzer evaluates HSTS, Content-Security-Policy, X-Frame-Options (or frame-ancestors), X-Content-Type-Options, Referrer-Policy, Permissions-Policy, Cross-Origin-Opener-Policy, Cross-Origin-Resource-Policy and Cross-Origin-Embedder-Policy, assigns an A–F grade and shows exactly what is missing and how to fix it. Each header carries a weight based on impact, CSP and HSTS weigh the most, and the grade reflects not just presence but the quality of the configuration, for example, an 'unsafe-inline' that the browser ignores because of a nonce/hash is not penalized, and a preload keyword without the 1-year max-age the preload list requires is flagged as ineffective. It also flags headers that disclose server information, such as Server and X-Powered-By, and shows the X-XSS-Protection status purely for information, since that filter was discontinued by browsers and does not change the grade. Importantly, by security design the tool makes no requests, you paste the headers and analysis runs 100% in the browser.
A security header is an order the server sends with the response, telling the browser to enforce a protection. On their own they do not fix a vulnerability in the code, but they close entire attack vectors when the browser honors the instruction, which is why they are a cheap, high-return layer.
The analyzer walks the main headers, scores each by weight and by the quality of its value, and turns the total into an A–F grade. A strong CSP is worth more points than a Referrer-Policy, reflecting how much each control reduces risk in practice.
Example 1, a well-configured HSTS. The ideal is strict-transport-security: max-age=15552000; includeSubDomains, that is, at least 180 days forcing HTTPS, covering subdomains and, when possible, with preload. A short max-age (under 6 months) or one without includeSubDomains still earns points, but the analyzer lowers the grade because protection is partial. A max-age of zero effectively disables HSTS.
Example 2, a weakened CSP. A policy with 'unsafe-inline' allows scripts embedded in the HTML, which is exactly the most common XSS vector, and a wildcard (*) in script-src/default-src opens up script origins. Both drop the CSP score; the recommended path is to use per-script nonces or hashes instead of 'unsafe-inline'.
You get the headers from DevTools (Network › click the main request › Response Headers) or from a terminal with curl -I https://yoursite.com. Beyond the security headers, the tool highlights the ones that leak information, Server, X-Powered-By and framework versions, which ease targeted attacks and apply a small penalty to the grade.
Two limits matter. First, the grade only measures header presence and quality; real security also depends on authentication, input validation, dependencies and TLS configuration. Second, the tool is local by design: if the server fetched any URL you entered, someone could point it at internal services (an SSRF attack) and expose the server IP. Pasting the headers avoids that and keeps everything in your browser.
Paste the code into your HTML and the tool shows up on your page, without J-Kit's navigation and ads. It still runs in the browser of whoever visits your site.
<iframe
src="https://jkit.tools/embed/en-US/security-headers-analyzer"
width="100%"
height="600"
style="border:0"
loading="lazy"
title="Security Headers Analyzer"
></iframe>These references help contextualize formulas, standards, APIs and limitations used on this page. They do not replace professional validation when a result has legal, financial, medical or operational impact.
For security. If the J-Kit server fetched any URL you entered, a malicious user could point it at internal services and discover the server IP (an attack known as SSRF). To avoid that, you paste the headers and the analysis is entirely local.
Paste headers in any format: Name: value (curl -I) or straight from DevTools, with the name and value on separate lines. The status line and blank lines are ignored.
The tool analyzes the main response security headers and produces a grade with risks and fixes. Nothing leaves your browser.
For security, this tool does not access any site or use the server as a proxy, that would expose the server IP and open an SSRF hole. You paste the headers and all analysis runs locally in your browser.