Daily Developer Tools
Paste raw HTTP response headers to grade them against OWASP and Mozilla Observatory security baselines.
Scores follow Mozilla Observatory–style deductions. Bonus points apply for modern isolation headers (COOP/COEP/CORP, Permissions-Policy).
Paste the response headers from any HTTP request and get a scored report of missing, weak, or deprecated security headers. Everything runs locally in your browser — no requests leave your machine.
max-age length, includeSubDomains, preload.unsafe-inline/unsafe-eval, wildcards, frame-ancestors.X-XSS-Protection, Public-Key-Pins) and information disclosure (Server, X-Powered-By).Secure, HttpOnly, SameSite.https:// request to evaluate it correctly.frame-ancestors in CSP supersedes X-Frame-Options in modern browsers.HttpOnly cookie is invisible to JavaScript — confirm your auth cookies are flagged as such.Server and X-Powered-By avoids leaking framework versions to attackers.Runs locally in your browser. No uploads.