Security Headers Checker (Paste curl -I)
Quick answer: run curl -I https://yoursite.example, paste the output, and see which security headers are missing. Nothing is sent from this page.
🔒 Headers are checked only inside your browser. We do not fetch your site and we do not save the paste.
Important: this grades the text you paste. It does not prove your live CDN config. Re-check after every deploy.
Try an example:
How to grade security headers
Why
Browsers obey response headers. Missing HSTS or CSP makes XSS, downgrade and clickjacking attacks easier.
What
You paste the response line and headers. The tool looks for HSTS, CSP, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy and COOP/CORP.
How
- Run
curl -I https://yoursite.example(or copy from DevTools). - Paste the output in the box.
- Fix red and amber items on your web server or CDN.
- Paste again to confirm.
Example, step by step
- Input: a curl -I dump with only
serverandcontent-type. - Result: several important headers missing.
- What it means: Sara adds HSTS and CSP in nginx, reloads, and the checker goes green.
Ravindra Bagale's Tip
Start with HSTS and Content-Security-Policy. Add X-Content-Type-Options=nosniff and a strict Referrer-Policy. Test after every reverse-proxy change.
Ravindra Bagale's Tip – मराठी
आधी HSTS आणि Content-Security-Policy ठेवा. X-Content-Type-Options=nosniff आणि कडक Referrer-Policy जोडा. Proxy बदलानंतर पुन्हा test करा.
Ravindra Bagale's Tip – हिंदी
पहले HSTS और Content-Security-Policy रखें. X-Content-Type-Options=nosniff और सख्त Referrer-Policy जोड़ें. Proxy बदलने के बाद फिर से test करें.
Frequently asked questions
Does this scan my website from your server?
No. You paste headers you already fetched. We never connect to your site.
How do I get headers?
On a computer: curl -I https://yoursite.example. Or DevTools → Network → click the document → Headers.
Is a missing header always a breach?
No. It is a hardening gap. Fix gaps before attackers abuse them.