Which page should I audit?
Your main HTML pages, ideally one anonymous and one logged-in page. Headers such as CSP and framing protection matter most on documents, less on images or scripts.
SECURITY HEADER AUDIT
Paste the response headers from your site and get an A to F grade with a finding and a fix for every check. It works offline on pasted text, so it can grade staging and internal sites that an online scanner cannot reach.
Loading the workbench.
About the Security header audit
How Can You Verify That Nothing Leaves This Browser?
You do not have to take our word that your headers stay here. Developer tools show every request a page makes, so you can watch this page work and confirm that nothing is sent. The check takes under a minute.
- Open your browser developer tools with
F12, orCmd+Option+Ion a Mac, and select the Network tab. - Reload the page and let it finish. You will see the page's own files, its web fonts, and one anonymous page-view request. Nothing has been typed yet, so none of them can contain your headers.
- Click the clear icon in the Network tab so that the log is empty.
- Paste real headers into any lane and read the result.
- Look at the Network tab again. It is still empty. For extra proof, turn on offline mode after the page loads and every lane keeps working.
Only two things can add a line to that log, and neither carries your headers. Submitting the feedback form sends the vote and comment you typed. Typing characters in a script the page has not displayed yet, such as Cyrillic or Greek, can make the browser fetch the matching font file, and that request names only the font.
2http never sends a request on your behalf: the request builder writes code for you to run, and the meta inspector reads source you paste instead of fetching a URL. The production site also sends a Content-Security-Policy header that tells your browser to refuse connections to anywhere except this site and the anonymous analytics endpoint.
What Does the Audit Check?
- Strict-Transport-Security: present, with a max-age of at least 180 days, ideally a year.
- Content-Security-Policy: parsed directive by directive, not substring-matched.
- Framing: CSP frame-ancestors or X-Frame-Options DENY or SAMEORIGIN.
- X-Content-Type-Options, Referrer-Policy, and Permissions-Policy.
- Cross-origin isolation: COOP, CORP, and COEP.
- Leaks and risks: version numbers in Server, X-Powered-By, wildcard or null CORS, cookie responses that shared caches may store, and an enabled X-XSS-Protection filter.
How Is the Grade Calculated?
Each check carries a weight from 1 to 5. A pass earns the full weight, a header that is present but weak earns half, and a missing or failing one earns nothing. The score is the share of available weight earned, and the grade follows the original thresholds:
- A at 95 percent or more, B at 85, C at 70, D at 55, E at 40, and F below that.
- If HSTS or CSP is missing or weak, the grade is capped at B, however high the score.
- Checks that do not apply, such as cache rules on a response that sets no cookie, are left out of the total.
What Changed From the Original Grader?
Five fixes make the grade honest. A header that is present but weak is now reported as weak, not missing. The deprecated Expect-CT is no longer scored, only noted. A Server header fails only when it reveals a version number, so nginx passes while nginx/1.18.0 does not. The cache advice no longer recommends no-store everywhere: caching is scored only on responses that set a cookie, where a shared cache could leak a session.
The CSP check now parses the policy. script-src falls back to default-src, and 'unsafe-inline' is not held against a policy that also uses a nonce, a hash, or 'strict-dynamic', because modern browsers ignore it then.
Why Grade Pasted Headers Instead of a URL?
An online scanner has to fetch your site from its own servers, so it cannot see staging hosts, intranet apps, or anything behind a login, and it learns which sites you are checking. Pasted headers have none of those limits. Copy them from DevTools while you are logged in, and nothing about your site leaves this browser.
What Other Lanes Are in the Audit & Build Section?
- Request builder: Build a request or import a curl command; get curl, fetch, axios, Python, and more.
- Meta tag generator: Generate title, description, Open Graph, and Twitter tags, or inspect pasted HTML.
Elsewhere in 2http: Header decoder, Cookie decoder, Cache-Control decoder, CORS checker, User-agent parser, and all eleven lanes on the 2http home page. Part of the 2suite.io privacy-first ecosystem.
Frequently Asked Questions
Why is my grade capped at B?
HSTS or Content-Security-Policy is missing or weak. They are the two critical headers, so the grade cannot reach A without both being strong.
Is X-XSS-Protection still needed?
No. The filter it controlled was removed from browsers because it could be abused. Send 0 or leave it out, and rely on a Content-Security-Policy instead.
Should I remove the Server header completely?
There is no need. A bare product name such as nginx reveals little. What matters is hiding the version number, which tells attackers which known vulnerabilities to try.