Security Header Analyzer

Server assisted Validation

A security-headers scanner with a letter grade, per-header findings, CSP directive analysis and recommended values, run either on pasted headers (private) or by fetching a public site.

Privacy: Processing happens in your browser where possible. Network checks are relayed through the Mutqan backend and are not stored.

How to use Security Header Analyzer

  1. Paste the response headers (curl -I output works) — or switch to scan mode and enter a public URL.
  2. Tick "Served over HTTPS" so HSTS and Secure-cookie rules apply.
  3. Click "Analyze" to get the grade and the header checks table.
  4. Fix high-severity findings first (missing CSP/HSTS, unsafe-inline scripts), then the medium ones.
  5. Deploy the recommended header set, re-scan and confirm the grade improved.

Security Header Analyzer features

  • Letter grade A+ to F with a weighted score and per-header pass/improve/missing status
  • CSP directive analysis: unsafe-inline/eval, wildcard and scheme sources, missing default-src/object-src/base-uri, report-only mode, JSONP-capable CDNs
  • HSTS validation: max-age ≥ 6 months, includeSubDomains, preload prerequisites
  • X-Frame-Options vs CSP frame-ancestors, X-Content-Type-Options, Referrer-Policy leakage, Permissions-Policy syntax
  • Cross-origin isolation (COOP, COEP, CORP), deprecated headers (X-XSS-Protection, HPKP, Expect-CT) and version-leaking Server/X-Powered-By
  • Recommended header set ready to paste into nginx, Apache, Cloudflare or your framework

Security Header Analyzer example

A typical Express site

Input:

content-security-policy: default-src 'self'; script-src 'self' 'unsafe-inline' https://cdn.example.com; img-src *
strict-transport-security: max-age=2592000
x-frame-options: SAMEORIGIN
referrer-policy: no-referrer-when-downgrade
x-powered-by: Express

Output:

Grade: D (48/100)
Content-Security-Policy — Missing / weak: 'unsafe-inline' allows inline scripts; object-src and base-uri are not restricted.
Strict-Transport-Security — Improve: max-age is 30 days; at least 6 months is recommended.
X-Content-Type-Options — Missing.
Referrer-Policy — Improve: no-referrer-when-downgrade leaks the full URL.
X-Powered-By — discloses the technology stack.

Frequently asked questions about Security Header Analyzer

How is the grade calculated?

Each header has a weight (CSP 25, HSTS 20, X-Content-Type-Options and framing 10 each, Referrer-Policy 8, Permissions-Policy 7, COOP/CORP/COEP 5). Passing earns the full weight, weak values half. A+ needs a strong CSP, HSTS with a long max-age and cross-origin isolation headers.

What makes a CSP weak?

'unsafe-inline' or 'unsafe-eval' in script directives, wildcard or scheme-only sources (*, https:, data:), missing object-src 'none', base-uri and default-src, or running in Report-Only mode.

What HSTS value should I use?

max-age=31536000; includeSubDomains; preload — at least six months is required for a pass, one year plus includeSubDomains for preload submission.

Do I still need X-Frame-Options with CSP frame-ancestors?

frame-ancestors wins in modern browsers; keep X-Frame-Options: DENY for legacy clients. The tool passes framing protection when either is correctly set.

Is pasting headers private?

Yes. Paste mode runs entirely in your browser; only scan mode sends the URL to the Mutqan relay, which fetches the page once.

Technical notes

Scoring weights reflect impact: CSP 25, HSTS 20, X-Content-Type-Options and framing protection 10 each, Referrer-Policy 8, Permissions-Policy 7 and 5 each for COOP, CORP and COEP (optional headers do not count when absent). A pass earns the full weight, a weak value half, and each high-severity finding removes a few extra points. A+ additionally requires a strong CSP, a passing HSTS and both COOP and CORP.

The CSP parser evaluates each directive separately, so a nonce or hash suppresses the unsafe-inline penalty (browsers ignore unsafe-inline when a nonce is present) and frame-ancestors is recognised as clickjacking protection even without X-Frame-Options.