Security Header Grader

Security Header Grader analyses the HTTP response headers of any website you visit and gives you an instant security grade (A–F), per-header scores, and actionable fix recommendations — all inside a clean popup.

What it checks (28 headers):

• Transport: Strict-Transport-Security (HSTS)
• Injection / XSS: Content-Security-Policy, X-XSS-Protection
• Clickjacking: X-Frame-Options
• MIME: X-Content-Type-Options, Content-Type
• Privacy: Referrer-Policy, Permissions-Policy, X-DNS-Prefetch-Control
• Cross-Origin Isolation: COOP, COEP, CORP
• CORS: Access-Control-Allow-Origin, Access-Control-Allow-Credentials
• Cookies: Set-Cookie flags (Secure, HttpOnly, SameSite)
• Caching: Cache-Control
• Info leaks: Server, X-Powered-By, X-AspNet-Version, X-Runtime, Via, X-Varnish, and more

Tech Stack Detection: Identifies 34 server, framework, and CMS signatures (Apache, Nginx, IIS, PHP, WordPress, Drupal, Express, Rails, and more) with risk ratings and direct links to CVE advisories.

Key features:

• Overall grade A–F with animated score ring
• Filter headers by category, missing, or issues
• Per-header score bar with detailed analysis and one-click fix copy
• Tech Stack tab showing info-leak findings with risk levels
• OWASP and MDN documentation links per header
• 100% local — no data ever leaves your browser, zero telemetry

Built for penetration testers, security researchers, and web developers.