iAbout
About Header Prism
Free tools for reading, grading and writing HTTP response headers, with the security policies that live in them.
What it does
Header Prism is built around a simple need: paste the headers a server sends, understand them, then produce the configuration that fixes what is missing. The header analyzer grades a response; the other seven tools write and check the individual headers: CSP generator, CSP evaluator, security headers, Permissions-Policy, CORS, Cache-Control and Set-Cookie.
How it works
Everything runs as JavaScript in your browser tab. Parsing, grading, hashing (with the browser's WebCrypto) and config generation happen locally, and nothing you paste is sent anywhere. That is also why the analyzer asks you to paste headers rather than fetch a URL: browsers do not allow a page to read another site's response headers. For a live check, the analyzer links to WebTraceCheck, a separate site, with your URL filled in.
The grade is published
There is no hidden formula. Content-Security-Policy is worth 25 points, Strict-Transport-Security 20, frame protection 15, X-Content-Type-Options, Referrer-Policy, Permissions-Policy and cross-origin isolation 10 each, minus up to 10 for version leaks and weak cookie flags. Every point gained or lost is listed in the report with the reason.
Practising what it preaches
This site sends the headers it recommends: a strict Content-Security-Policy that only allows its own files (plus Cloudflare's page-view counter), HSTS, X-Frame-Options, nosniff, a Referrer-Policy, a Permissions-Policy that disables unused features, and COOP and CORP. Paste them into the analyzer to check.
Limits
Headers are one layer of defence. A good grade does not mean an application is free of vulnerabilities, and the checks reflect current browser behaviour, which keeps changing. If something looks wrong, treat the specs and browser documentation as the final word.