Sada Files
  1. 1Choose file
  2. 2Adjust
  3. 3Download

Check a public page

Enter a URL in the settings and run the check. Our server fetches the page through an SSRF-safe fetcher, analyses it in memory and stores nothing.

Fetched by our server — public addresses only, nothing stored or logged.

Security Headers Analyzer & Grader online, free

Evaluate and grade website security headers (CSP, HSTS, X-Frame-Options, Permissions-Policy) with actionable remediation advice.

  • Runs in your browser — no upload
  • Free, no sign-up, no watermark
  • TXT
How to use Security Headers Analyzer & Grader · Security Headers Analyzer & Grader — frequently asked questions

How to use Security Headers Analyzer & Grader

  1. 1

    Add your TXT file

    Drop a file on the page, paste it, or click Select Files. Nothing is uploaded — it opens straight in your browser.

  2. 2

    Fine-tune the settings

    Set source mode in the Fine-tune panel, or keep the defaults — they suit most files.

  3. 3

    Run Security Headers Analyzer & Grader

    Press the start button. Processing happens on your device, usually in seconds.

  4. 4

    Download the result

    Save the finished file, or continue with another tool without downloading in between.

What Security Headers Analyzer & Grader can do

  • Source Mode: url and paste
  • Private by design — files are processed in your browser and never uploaded
  • Free with no sign-up, no watermark and no daily limit

Security Headers Analyzer & Grader — frequently asked questions

What are HTTP security headers?

HTTP security headers instruct modern web browsers to enforce strict safety boundaries against cross-site scripting (XSS), clickjacking, MIME sniffing, unauthorized framing, and insecure connections.

Which headers are evaluated in the security grade?

The grader scores the presence and configuration quality of Content-Security-Policy (CSP), Strict-Transport-Security (HSTS), X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy.

How is the security grade calculated?

Grades range from A+ (optimal protection with strict CSP and HSTS preloading) down to F (no protective headers present). Each missing or misconfigured header deducts points from the overall score.

Can I grade headers privately from my own staging or internal environment?

Yes. Copy the response headers from your staging environment or command line, switch to Paste mode, and paste them into the textarea. The grading algorithm will evaluate them locally in your browser.

Does this tool provide remediation advice for missing headers?

Yes. Each identified vulnerability or missing header includes an explanation of the security risk and recommended web server configuration snippets (for Nginx, Apache, Caddy, Cloudflare, and Vercel).

Related tools

All SEO & Marketing Tools