Security Headers Sanitizer

Paste HTTP response headers to check the important security headers, find weak or deprecated values, and produce a clean nginx add_header block.

Headers

One Name: value per line

Report

Paste headers and analyze them.

What is checked

Content-Security-Policy — presence of a default or script policy, and warnings for unsafe-inline / unsafe-eval.
Strict-Transport-Security — a long max-age; includeSubDomains and preload are reported as recommendations.
X-Content-Type-Options, X-Frame-Options, Referrer-Policy and the Cross-Origin isolation headers.
Fingerprinting / legacy headers such as Server, X-Powered-By and X-XSS-Protection.

The sanitizer normalizes names, trims values, removes duplicates and empty headers, and keeps the first occurrence of each header.

nginx expands $name inside add_header values. The report warns when a value contains $, because there is no reliable backslash escape; rename or avoid the variable text in nginx.