Security Headers Analyzer

Continue in the tool

HTTP security headers

HTTP Security Headers: What HSTS and CSP Actually Do

An HTTP security header is an instruction the server sends in the response and the browser enforces on its own, with no extra code on the page. Strict-Transport-Security and Content-Security-Policy carry the heaviest technical weight on this list because they close the two most exploited gaps, HTTP downgrade and script injection, yet most sites still send only a fraction of them.

Why HSTS and CSP Weigh More Than the Rest

Content-Security-Policy is the heaviest control on the list because it restricts where the browser can load and execute scripts from, blocking much of XSS injection once the script-src directive (or default-src as a fallback) avoids 'unsafe-inline' and wildcards (*). Strict-Transport-Security follows close behind: it tells the browser to never attempt plaintext HTTP for that domain for the time set in max-age, which closes downgrade and SSL-stripping attacks that intercept the first request before the redirect to HTTPS.
HSTS's max-age value is counted in seconds: 15552000 equals 180 days, the floor considered reasonable, and anything below that is treated as a weak policy. To join browsers' preload list (hstspreload.org), the requirement rises to 31536000 seconds, 1 year, with includeSubDomains mandatory; without both, the preload directive shows up in the header but has no effect at all. Without includeSubDomains, any forgotten subdomain keeps accepting plain HTTP connections normally.
The X-XSS-Protection header is this topic's real trap: the filter it controlled was removed from Chrome, Edge and Safari, so setting it to anything other than 0 does nothing in current browsers, and old versions of that filter were themselves exploited to leak information from the page. Today's recommendation is to remove the header entirely or set it to 0, and rely fully on Content-Security-Policy for XSS protection. Identifying headers like Server and X-Powered-By protect nothing and still count against the score, because they reveal the exact stack for an attacker to target with known exploits.

Three Real Responses, Three Different Scores

Strong setup: HSTS, CSP, X-Content-Type-Options and Referrer-Policy

Input: Strict-Transport-Security: max-age=31536000; includeSubDomains; preload / Content-Security-Policy: default-src 'self' / X-Content-Type-Options: nosniff / Referrer-Policy: strict-origin-when-cross-origin
Expected output: nota 61/100, grau C (4 de 10 headers analisados presentes)

Even with the two highest-weight headers set correctly (HSTS with a valid preload, CSP with a restricted default-src), the score lands at C because only 4 of the 10 analyzed controls are present; Permissions-Policy, COOP, CORP and COEP are still missing.

CSP with 'unsafe-inline' and a nonce together

Input: Content-Security-Policy: default-src 'self'; script-src 'nonce-r4nd0m' 'unsafe-inline'
Expected output: CSP pontua 25/25 (nota geral 24/100, grau F)

'unsafe-inline' next to a nonce does not weaken the policy: current browsers ignore it once the same directive already carries a nonce or hash, so it only works as a fallback for very old browsers. The overall score stays low because no other header is present.

Only headers that disclose the stack

Input: Server: nginx/1.18.0 / X-Powered-By: Express
Expected output: nota 0/100, grau F, 2 headers de disclosure detectados

None of the 10 security controls is present, and the two headers sent only reveal the stack (nginx and Express) to anyone looking for known exploits in those versions; each disclosure header subtracts up to 3 points, capped at 8 total.

Full tool FAQ

Why doesn’t the tool fetch the site’s headers itself?

For security. If the J-Kit server fetched any URL you entered, a malicious user could point it at internal services and discover the server IP (an attack known as SSRF). To avoid that, you paste the headers and the analysis is entirely local.

How do I get the response headers?

What is HSTS and why does it matter?

Why is 'unsafe-inline' in CSP bad?

Does an A grade mean I am 100% secure?

Can I analyze an API’s headers?

What does X-Content-Type-Options: nosniff do?

What lowers my grade besides missing headers?

Frequently asked questions

What is the difference between X-Frame-Options and CSP frame-ancestors?

Both prevent clickjacking by blocking the site from loading inside someone else's iframe, but frame-ancestors is the newer Content-Security-Policy directive and is considered today's recommended approach; when it is present, a missing X-Frame-Options stops being a problem.

Do I need to enable X-XSS-Protection?

No. The filter this header controlled was removed from Chrome, Edge and Safari, so it has no effect in current browsers; the recommendation is to remove the header, or set it to 0, and rely on Content-Security-Policy for XSS protection instead.

What is the minimum recommended max-age for HSTS?

At least 15552000 seconds (180 days) for a policy considered strong; to join browsers' preload list, the requirement rises to 31536000 seconds (1 year), always paired with includeSubDomains.

Why are Server and X-Powered-By penalized if they are not security headers?

Because they leak information that helps an attacker, the exact software and version of the server or framework, which makes it easier to target known exploits for that specific version; the penalty is small (up to 3 points per header, capped at 8 total) but it still counts against the final score.

Next steps

Continue in the tool

Open full tool

HTTP security headers

HTTP Security Headers: What HSTS and CSP Actually Do

Why HSTS and CSP Weigh More Than the Rest

Content-Security-Policy is the heaviest control on the list because it restricts where the browser can load and execute scripts from, blocking much of XSS injection once the script-src directive (or default-src as a fallback) avoids 'unsafe-inline' and wildcards (*). Strict-Transport-Security follows close behind: it tells the browser to never attempt plaintext HTTP for that domain for the time set in max-age, which closes downgrade and SSL-stripping attacks that intercept the first request before the redirect to HTTPS.

HSTS's max-age value is counted in seconds: 15552000 equals 180 days, the floor considered reasonable, and anything below that is treated as a weak policy. To join browsers' preload list (hstspreload.org), the requirement rises to 31536000 seconds, 1 year, with includeSubDomains mandatory; without both, the preload directive shows up in the header but has no effect at all. Without includeSubDomains, any forgotten subdomain keeps accepting plain HTTP connections normally.

The X-XSS-Protection header is this topic's real trap: the filter it controlled was removed from Chrome, Edge and Safari, so setting it to anything other than 0 does nothing in current browsers, and old versions of that filter were themselves exploited to leak information from the page. Today's recommendation is to remove the header entirely or set it to 0, and rely fully on Content-Security-Policy for XSS protection. Identifying headers like Server and X-Powered-By protect nothing and still count against the score, because they reveal the exact stack for an attacker to target with known exploits.

Three Real Responses, Three Different Scores

Strong setup: HSTS, CSP, X-Content-Type-Options and Referrer-Policy

Input: Strict-Transport-Security: max-age=31536000; includeSubDomains; preload / Content-Security-Policy: default-src 'self' / X-Content-Type-Options: nosniff / Referrer-Policy: strict-origin-when-cross-origin
Expected output: nota 61/100, grau C (4 de 10 headers analisados presentes)

CSP with 'unsafe-inline' and a nonce together

Input: Content-Security-Policy: default-src 'self'; script-src 'nonce-r4nd0m' 'unsafe-inline'
Expected output: CSP pontua 25/25 (nota geral 24/100, grau F)

Only headers that disclose the stack

Input: Server: nginx/1.18.0 / X-Powered-By: Express
Expected output: nota 0/100, grau F, 2 headers de disclosure detectados

Full tool FAQ

Why doesn’t the tool fetch the site’s headers itself?

How do I get the response headers?

What is HSTS and why does it matter?

Why is 'unsafe-inline' in CSP bad?

Does an A grade mean I am 100% secure?

Can I analyze an API’s headers?

What does X-Content-Type-Options: nosniff do?

What lowers my grade besides missing headers?

Frequently asked questions

What is the difference between X-Frame-Options and CSP frame-ancestors?

Do I need to enable X-XSS-Protection?

What is the minimum recommended max-age for HSTS?

At least 15552000 seconds (180 days) for a policy considered strong; to join browsers' preload list, the requirement rises to 31536000 seconds (1 year), always paired with includeSubDomains.