HTTP Header Analyzer

What Are HTTP Response Headers?

HTTP headers are name-value pairs exchanged between a browser and a server alongside the actual page content. Response headers — the ones this tool analyzes — are sent by the server and control how the browser treats the response: which media type it is, how long it can be cached, what security policies apply, how cross-origin requests are handled, and more. A well-configured set of response headers is one of the cheapest and highest-impact ways to improve both the security and performance of a website.

This analyzer parses the raw headers you paste, groups them into categories such as Security, Caching, Performance, Content, CORS, Cookies, and Server, and explains what each one does. It then checks the value of every security header, not just whether it is there, and produces a weighted score out of 100 with a pass, warning or fail for each check. Importantly, the tool does not fetch any URL or contact your server — it only inspects the header text you provide, which keeps the whole process fast and private.

How to Use This HTTP Header Analyzer

Paste your raw HTTP response headers into the text area on the left, either as Name: Value lines or exactly as copied from the browser DevTools, where name and value sit on separate lines. A status line like HTTP/1.1 200 OK is recognized too, and if you paste the output of curl -IL with redirects, the tool scores the final response. If you just want to see how it works, click Load Example to fill the field with a realistic sample set of headers. Then click Analyze Headers, or press Ctrl+Enter, to run the breakdown.

The right-hand pane lists every parsed header grouped by category with a short description, and the Security Score section appears below with a percentage bar and an itemized list of checks — HSTS, CSP, clickjacking protection (X-Frame-Options or CSP frame-ancestors), MIME sniffing protection, Referrer-Policy, Permissions-Policy, version numbers in the Server and X-Powered-By headers, and cookie flags if the response sets cookies — each marked passed, warning or failed with the reason. Use the Clear button to reset the field and start over.

Real-World Use Cases

• Security hardening — Confirm a site sends HSTS, CSP, and anti-clickjacking headers before going live.
• Caching review — Inspect Cache-Control, ETag, and Vary to verify your caching strategy is correct.
• Debugging CORS — Read the Access-Control-* headers a server returns to diagnose cross-origin failures.
• Information-leak checks — Spot revealing Server or X-Powered-By headers that expose your tech stack.
• Learning and teaching — Paste real headers to understand what each one controls, with built-in descriptions for dozens of headers.

Tips for Better Header Configuration

• Set Strict-Transport-Security with a long max-age and includeSubDomains to enforce HTTPS everywhere.
• Prefer a strong Content-Security-Policy over the legacy X-XSS-Protection header for XSS defense.
• Use X-Content-Type-Options: nosniff and X-Frame-Options: DENY or SAMEORIGIN (or CSP frame-ancestors) on every response. ALLOW-FROM no longer works in any current browser.
• Remove the version from the Server header and drop X-Powered-By so you do not advertise software versions to attackers.
• Paste headers exactly as captured — Name: Value lines or the DevTools copy — so the parser reads every value correctly.

How to Get Your Headers

You can capture response headers to paste here using any of these methods:

• Browser DevTools — Open the Network tab, click a request, and copy from “Response Headers”.
• curl — Run curl -I https://yoursite.com in your terminal (add -L to follow redirects; the tool scores the final response).
• wget — Run wget --server-response --spider https://yoursite.com.

Features

• Categorized breakdown — Headers are grouped into Security, Caching, Performance, Content, CORS, Cookies, Server, and more, each with a description.
• Weighted security score — A 0–100 score that checks values, not just presence: HSTS, CSP, clickjacking protection, nosniff, Referrer-Policy, Permissions-Policy, server versions and cookie flags.
• Actionable recommendations — Each failed check explains what to add and why it matters.
• Status lines and redirects — Recognizes status lines such as HTTP/1.1 200 OK and separates the responses of a redirect chain.
• Load Example and Clear — Try a realistic sample instantly or reset with one click.
• 100% client-side — your data never leaves your browser; the tool analyzes pasted text and never fetches a URL.

Frequently Asked Questions

Does this tool fetch headers from a URL?

No. The analyzer only inspects the header text you paste into the input field — it never makes a network request to a URL or contacts your server. You capture the headers yourself (for example with browser DevTools or curl -I) and paste them in, which keeps the analysis fully client-side and private.

How is the security score calculated?

There are up to nine weighted checks: HSTS (20), CSP (20), clickjacking protection (15), X-Content-Type-Options (15), Referrer-Policy (10), Permissions-Policy (10), Server version (5), X-Powered-By (5) and, only if the response sets cookies, cookie flags (10). Each check reads the value. A pass earns the full weight, a warning half, a fail nothing. Some examples: HSTS needs a max-age of at least six months, and max-age=0 fails because it switches HSTS off. A CSP that allows scripts via 'unsafe-inline' (without a nonce or hash) or * gets a warning. X-Frame-Options: ALLOW-FROM fails because no current browser supports it, while CSP frame-ancestors counts as clickjacking protection. A Server header without a version number is fine. The score is the points earned divided by the points possible.

What format should I paste the headers in?

Either one header per line in Name: Value format, for example X-Frame-Options: SAMEORIGIN, or the copy from the browser DevTools with the name on one line and the value on the next. Status lines such as HTTP/1.1 200 OK, the < prefix of curl -v and several responses from curl -IL are handled too; with redirects, the last response is scored. Lines that are not headers are skipped and counted, so you can see if something was not read.

What is a good security score?

80% or more is rated good (green), 50–79% fair, below 50% weak (red). A strong score needs the headers to be set to values that actually protect: a long HSTS max-age, a CSP that limits scripts, clickjacking protection, nosniff and no version numbers in Server or X-Powered-By. The score only rates the headers you paste. It does not test the site itself, so it is no substitute for a security review.

Do all websites need security headers?

Yes. Security headers are a low-cost, high-impact way to protect visitors. They help prevent common attacks such as clickjacking, cross-site scripting, MIME type confusion, and protocol downgrade, and they are widely recommended as a baseline for any production site.

Is the HTTP Header Analyzer free and private?

Yes. It is completely free and runs entirely in your browser using client-side JavaScript. Because it only parses the text you paste and never transmits it anywhere, the headers you analyze never leave your device.