Security Headers
Paste a response's headers to score its security headers (CSP, HSTS, CORS, cookies, framing) and get the fix for each issue.
About this tool
Paste the response headers of a page, copied from your browser's network panel or from curl -I. They are scored against common checks for transport security, Content-Security-Policy, framing, CORS, cookies, referrer and permissions policy, and each issue comes with a suggested fix.
The score reflects only the headers you paste, so a header left out counts as missing. It is a checklist, not a penetration test. Cookie and Authorization values are masked in the report, and nothing is fetched or sent. At most 200,000 characters are read.
Reading the headers of the page you have open, comparing two responses and building a Content-Security-Policy are features of the DevKit Forge browser extension.