Online Tool Store
Security Headers & Web Firewall (WAF) Auditor
Grade a site's security headers and detect the WAF/CDN provider from pasted response headers. Runs entirely in your browser.
🔒 This tool runs entirely in your browser. Your files are never uploaded to a server.
Example shown — paste headers from `curl -I <url>` or your browser's Network tab.
Security header grade
—
Detected WAF / CDN
How it works
- Retrieve response headers with `curl -I <url>` or your browser's Network tab.
- Paste them in.
- See a security header grade and any detected WAF/CDN provider.
FAQ
How is the grade calculated?
Each of seven commonly recommended security headers contributes points if present (weighted roughly by security impact — Content-Security-Policy and Strict-Transport-Security count for the most). The total maps to a letter grade, similar in spirit to third-party security header scanners.
How does WAF/CDN detection work?
It checks your pasted headers against publicly documented signatures each provider is known to emit — Cloudflare's `CF-RAY`, AWS CloudFront's `X-Amz-Cf-Id`, Fastly's `X-Fastly-Request-Id`, and similar real header patterns, not a guess.
Why do I need to paste headers instead of entering a URL?
A browser can't read another origin's response headers directly (a CORS restriction) — a live check needs a server-side HTTP request. Retrieve headers with `curl -I <url>` or your browser's Network tab and paste them here.
Is my data uploaded anywhere?
No — parsing, scoring, and detection all happen entirely in your browser. Nothing is sent to a server, and no live request to any URL is made.
How we compare
| Feature | Online Tool Store | Third-party live scanners | Manual header review |
|---|---|---|---|
| Works on staging/internal URLs | ✓ | Requires a publicly reachable URL | ✓ |
| Grade + WAF detection in one pass | ✓ | ✓ | Manual, slow |
For a fast audit of headers you already pulled from a staging environment a public scanner can't reach, this is the quicker path.