Back to Free Tools
FREE TOOLS
Security Header Inspector
Inventory six common browser security headers and report missing, duplicate or weak obvious values.
HTTP response header fields
security-header-inspector.json (complete report and generated source where applicable)
Browser only
Runs locally in your browser. Your files, pasted content and generated output are not uploaded. Reset clears this tool’s working data.
This tool needs JavaScript. If it does not load, refresh the page and try again.
How to use this tool
- Enter values using the displayed examples; observe the documented input shape and limits.
- Choose Calculate result. Review the complete JSON report and any generated source text it contains.
- Download result to save the complete report; copy the generated source member into your project when relevant. Reset restores examples and clears output.
Examples
HTTP response header fields: Strict-Transport-Security: max-age=31536000
Content-Security-Policy: default-src 'self'
X-Content-Type-Options: nosniff
Referrer-Policy: no-referrer
X-Frame-Options: DENY
Permissions-Policy: camera=()
Limitations
- Pasted HTTP header fields only; no live audit or security score. Presence and bounded syntax checks do not prove a secure site or correct CSP.
- Maximum 100,000 UTF-16 units per field, 400,000 UTF-8 combined input bytes, 4 MiB output and 30 seconds in a local worker. Tool-specific bounds may be tighter.
- Generated snippets are source text inside the JSON download. They are never executed by this tool. Local inspection does not verify remote systems or establish standards certification.
Related tools
No items found.