HTTP Response Header Analyzer
Paste a set of HTTP response headers (for example from curl -I or your browser's DevTools) and get a graded report of the recommended security headers: HSTS, CSP, X-Content-Type-Options, clickjacking protection, Referrer-Policy, and Permissions-Policy, each graded on the site's severity scale with a short note saying what it found. It analyses only what you paste.
This is generated in browser and is not sent to pah.moi servers.
About this tool3 paragraphs
A real response can carry a live Set-Cookie session and version banners you may not want to publish, so the analyzer is gated behind a short acknowledgement; past it, a made-up sample is loaded so you can see the grading straight away.
Headers are graded on their value, not on being present. An HSTS max-age under six months is Weak rather than Good; a policy allowing unsafe-inline, unsafe-eval or a wildcard source is Weak, and a CSP opens directive by directive. Every Set-Cookie is audited for Secure, HttpOnly and SameSite, with SameSite=None without Secure and a broken __Host- or __Secure- prefix rule counted as failures rather than as weaknesses. Server, X-Powered-By, Via and their relatives are listed separately as disclosure.
The report is exactly as good as the paste, and that is its real limit: headers a CDN or proxy adds on the way out are not here unless you captured them from the outside, and six Goods describe one response rather than a site.
sec-headers-cli from the site's source with:
cargo build --release --bin sec-headers-cliSource and licence terms