HTTP Security Headers Analyzer

Paste any HTTPS URL. We'll fetch it through an SSRF-safe client (no internal networks, no metadata endpoints), inspect the response headers, and grade the page on the standard security-headers checklist — CSP, HSTS, the X-headers, Referrer-Policy, Permissions-Policy, and the cross-origin isolation set.