Analyze the HTTP security headers of any website. Check CSP, HSTS, X-Frame-Options, Referrer-Policy, Permissions-Policy and more – free and directly in your browser.
They protect your visitors from XSS, clickjacking, MIME sniffing and data leaks.
Prevents XSS and script injection. The single most important header.
Forces HTTPS for all future connections and blocks downgrade attacks.
Prevents clickjacking by disallowing embedding in foreign frames.
Stops MIME sniffing and prevents browsers from misinterpreting files.
Controls how much referrer information is sent to other sites.
Defines which browser APIs (camera, mic, geolocation) the page may use.
Yes. The Fasqoo Security & Header Analyzer is completely free and runs directly in the browser – no account, no tracking.
No. The request goes through a Cloudflare Worker and is not stored. No cookies are set and no analytics data is collected.
The analyzer uses a server-side worker to expose arbitrary response headers. Some servers strip headers or only send them under certain conditions.
Yes. You can copy the report to your clipboard as text or export it as a JSON file.
The grade is based on six security headers with individual weights (CSP 25, HSTS 25, XFO 15, Referrer 15, XCTO 10, Permissions 10). Missing headers reduce the score, warnings are partially credited.