Grade Simulator

Paste any response-header block — a curl -Idump, your browser's copied response headers, or a config you're about to ship — and get an instant A+ to F grade with the exact fix for every gap. Nothing is fetched and no key is needed: the grade is computed from what you paste, so you can test a Content-Security-Policy or HSTS change before it goes live. It runs the same engine as our live scanner.

No scan, no key — graded locally from what you paste.

Want it automated? The API does this too: POST /api/v1/simulate with { "headers": "<block>" }. See the docs.