AdminForge Star on GitHub

HTTP security headers

Server side

Grade a site's response headers and see exactly which protections are missing

Input

https is assumed if you leave the scheme off. Redirects are followed and re-checked.

This tool runs on the AdminForge server, which needs to reach the target you enter. Nothing is stored or logged. Do not paste secrets into a server-side tool on an instance you do not control.

Fill in the form and run the tool. Results appear here.

The grade weights headers by how much they actually change browser behaviour, so a strong CSP counts for more than a Permissions-Policy. It is a starting point for a hardening conversation, not a compliance verdict — a policy can be present and still be permissive.