HTTP Headers & CORS
Paste HTTP response headers for security recommendations and a rule-of-thumb grade, or paste CORS headers and analyse them against the origin, method and headers you expect. Nothing is fetched.
A report on HSTS, CSP, framing, content-type and other security headers, with fixes. Paste headers; nothing is fetched. The grade weights are our own and opinionated.
Paste response headers: nothing is fetched. The grade weights are arbitrary and some rules (such as X-XSS-Protection) are opinionated; treat the grade as a prompt to read the findings.
Analyse pasted CORS response headers against an origin, method and request headers. It does not request the URL: you paste the headers. Nothing is sent anywhere.
This analyses headers you paste. It never requests the URL, so it cannot tell you how a server really responds.