HTTP Header Analyzer

What Are HTTP Response Headers?

HTTP headers are name-value pairs exchanged between a browser and a server alongside the actual page content. Response headers — the ones this tool analyzes — are sent by the server and control how the browser treats the response: which media type it is, how long it can be cached, what security policies apply, how cross-origin requests are handled, and more. A well-configured set of response headers is one of the cheapest and highest-impact ways to improve both the security and performance of a website.

This analyzer parses the raw headers you paste, groups them into categories such as Security, Caching, Performance, Content, CORS, Cookies, and Server, and explains what each one does. It then runs a set of security checks and produces a weighted score out of 100 with a clear PASS or FAIL for each critical header. Importantly, the tool does not fetch any URL or contact your server — it only inspects the header text you provide, which keeps the whole process fast and private.

How to Use This HTTP Header Analyzer

Paste your raw HTTP response headers into the text area on the left, with each header on its own line in Name: Value format (a status line like HTTP/1.1 200 OK is recognized too). If you just want to see how it works, click Load Example to fill the field with a realistic sample set of headers. Then click Analyze Headers, or press Ctrl+Enter, to run the breakdown.

The right-hand pane lists every parsed header grouped by category with a short description, and the Security Score section appears below with a percentage bar and an itemized list of checks — HSTS, CSP, X-Frame-Options, MIME sniffing protection, Referrer-Policy, Permissions-Policy, and exposure of the Server and X-Powered-By headers — each marked passed or failed with a recommendation. Use the Clear button to reset the field and start over.

Real-World Use Cases

• Security hardening — Confirm a site sends HSTS, CSP, and anti-clickjacking headers before going live.
• Caching review — Inspect Cache-Control, ETag, and Vary to verify your caching strategy is correct.
• Debugging CORS — Read the Access-Control-* headers a server returns to diagnose cross-origin failures.
• Information-leak checks — Spot revealing Server or X-Powered-By headers that expose your tech stack.
• Learning and teaching — Paste real headers to understand what each one controls, with built-in descriptions for dozens of headers.

Tips for Better Header Configuration

• Set Strict-Transport-Security with a long max-age and includeSubDomains to enforce HTTPS everywhere.
• Prefer a strong Content-Security-Policy over the legacy X-XSS-Protection header for XSS defense.
• Use X-Content-Type-Options: nosniff and X-Frame-Options: DENY or SAMEORIGIN on every response.
• Remove or obscure the Server and X-Powered-By headers so you do not advertise software versions to attackers.
• Paste headers exactly as captured — one per line in Name: Value form — so the parser reads every value correctly.

How to Get Your Headers

You can capture response headers to paste here using any of these methods:

• Browser DevTools — Open the Network tab, click a request, and copy from "Response Headers".
• curl — Run curl -I https://yoursite.com in your terminal.
• wget — Run wget --server-response --spider https://yoursite.com.

Features

• Categorized breakdown — Headers are grouped into Security, Caching, Performance, Content, CORS, Cookies, Server, and more, each with a description.
• Weighted security score — A 0–100 score with PASS/FAIL on HSTS, CSP, X-Frame-Options, nosniff, Referrer-Policy, Permissions-Policy, and exposed server headers.
• Actionable recommendations — Each failed check explains what to add and why it matters.
• Status line parsing — Recognizes the response status line such as HTTP/1.1 200 OK.
• Load Example and Clear — Try a realistic sample instantly or reset with one click.
• 100% client-side — your data never leaves your browser; the tool analyzes pasted text and never fetches a URL.

Frequently Asked Questions

Does this tool fetch headers from a URL?

No. The analyzer only inspects the header text you paste into the input field — it never makes a network request to a URL or contacts your server. You capture the headers yourself (for example with browser DevTools or curl -I) and paste them in, which keeps the analysis fully client-side and private.

How is the security score calculated?

The tool runs eight weighted checks — HSTS (20), CSP (20), X-Frame-Options (15), X-Content-Type-Options nosniff (15), Referrer-Policy (10), Permissions-Policy (10), and hidden Server and X-Powered-By headers (5 each). It sums the weights of the passed checks and shows the result as a percentage out of 100.

What format should I paste the headers in?

Paste each header on its own line in Name: Value format, for example X-Frame-Options: SAMEORIGIN. An optional status line such as HTTP/1.1 200 OK is detected automatically. If no valid headers are found, the tool tells you to check the format.

What is a good security score?

A strong score comes from sending all the critical headers: HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy, while hiding the Server and X-Powered-By headers. Scores of 80% or higher are shown in green, indicating most key protections are in place.

Do all websites need security headers?

Yes. Security headers are a low-cost, high-impact way to protect visitors. They help prevent common attacks such as clickjacking, cross-site scripting, MIME type confusion, and protocol downgrade, and they are widely recommended as a baseline for any production site.

Is the HTTP Header Analyzer free and private?

Yes. It is completely free and runs entirely in your browser using client-side JavaScript. Because it only parses the text you paste and never transmits it anywhere, the headers you analyze never leave your device.