Security Headers Scanner
Inspect pasted response headers reliably, with an optional browser URL check when CORS exposes the values.
Choose a Header Source
Copy headers from the browser Network panel, curl -I, a reverse proxy, or another HTTP client. This path does not make a network request.
Header review
Header presence and value notes will appear here.
Paste headers when you need an answer about presence
Security headers such as CSP, HSTS, framing controls, referrer policy, Permissions Policy, and cross-origin isolation headers are ordinary HTTP response fields. If you already have the response block from DevTools or curl, parsing that text avoids CORS ambiguity and lets the page say whether a header is actually present in what you pasted.
The URL check has a browser-shaped blind spot
A browser is intentionally not a general-purpose raw HTTP client. Cross-origin fetches can fail entirely, and successful CORS responses still expose only headers the Fetch rules allow script to read. That is why the URL mode uses “visible” instead of “present.”
Presence is not the same as a sound value
A CSP header can exist and still allow risky sources. HSTS can be present with max-age=0, which disables the policy. X-Frame-Options can contain an unsupported value, and nosniff only has the intended effect when Content-Type is correct. The value notes here catch a few obvious cases without pretending to replace header-specific testing.
Not every listed header belongs on every response
COOP and COEP can alter window relationships and resource loading. CORP is about how a resource may be included by other sites. Permissions Policy depends on browser features the page actually uses. Their absence is therefore shown neutrally rather than as a red failure.
What leaves the browser
Pasted headers are parsed locally and are not sent to a Yoryantra server by this page. URL mode makes a direct GET request from your browser to the URL you enter with credentials omitted and no referrer. Avoid URL mode for endpoints where even a GET request can change state.
References for the two different questions here
The OWASP HTTP Security Response Headers Cheat Sheet explains why individual security headers are deployed. The WHATWG Fetch Standard defines the CORS and response-header exposure rules that limit the browser URL check.