SOSECIO
Local processing active
Use tool

HTTP security headers analyzer

Paste HTTP response headers and review HSTS, CSP, Report-Only policies, Reporting-Endpoints/Report-To/NEL, Document-Policy, Origin-Agent-Cluster, cross-origin isolation headers, and Set-Cookie attributes locally in your browser.

Local paste analyzer; no URL request, no input submission, no ranking label, no full security audit. Input limit is 64 KiB.

The profile only changes recommendation weight and ordering; it does not request URLs, read or write URL parameters, or persist input.

-Top priority
0High priority
0Needs review
0Info

Header groups

Grouped only by header names and rules covered on this page. Raw values are not carried and input is not passed across pages. Next-step links only open tool pages.

Specialized checks
  • Waiting for analysis
Parsed without specialized checks
  • Waiting for analysis
Header Value State Summary
Waiting for analysis
Redacted JSON
Redacted report
Paste response headers, then analyze. This page does not request URLs or submit input to the backend.

Recommended from common tool workflows. This section does not read or pass page input.

CORS response header analyzerAnalyze pasted CORS response headers locally, with structured tables, policy summaries, and common risk hints.Cookie parser and security checkParse Cookie and response cookie headers locally, then review Secure, HttpOnly, SameSite, Domain, Path, Expires, Max-Age, and Partitioned.CSP sandbox lookupLook up CSP sandbox directive behavior, iframe sandbox tokens, allow-* combinations, popups, downloads, and navigation limits.Hash calculatorCalculate SHA-1, SHA-256, SHA-384, and SHA-512 digests with Web Crypto for UTF-8, Hex, Base64, and Base64URL byte input.