Security Headers Analyser

Grab the headers with curl -sSI https://example.com and paste the output below. Works on localhost and staging too, which online scanners cannot reach.

The headers you paste are parsed in your browser and are never sent anywhere. Analyse with your network tab open and check for yourself: no request carries them.