Security Header Checker
Paste the HTTP response headers your site actually sends and get a scored breakdown against CSP, HSTS, X-Frame-Options, Referrer-Policy, Permissions-Policy, and more. Browsers won't let a website silently read another site's response headers — so unlike a typical "enter any URL" checker, this one asks you to paste headers you've already retrieved, which means it always works and nothing about your site is sent anywhere.
See it work first: ByteTempest's own headers
This button fetches this very page's response headers directly from your browser — a same-origin request, so there's no trick involved. Use it to see what a fully-scored result looks like.
How to get your site's response headers
Terminal (Mac/Linux/Windows)
Run curl -I https://yoursite.com and copy the full output. Add -L if your site redirects (e.g. http → https).
Chrome / Edge DevTools
Open DevTools (F12) → Network tab → reload the page → click the first request → "Headers" tab → copy everything under "Response Headers."
Online header checkers
Sites like securityheaders.com also work — copy the raw header output from their results page and paste it here for ByteTempest's specific scoring breakdown.