HTTP Headers🔒 100% local
Explain HTTP response headers, flag the security-relevant ones and summarise a pasted response. Privacy-first, no server uploads, no tracking.
Related Tools
Explains the raw HTTP headers you paste: a name it recognises gets a category and a plain-language meaning, anything outside the table is marked as non-standard, and the report finishes with a count plus a check for the four security headers people most often forget (HSTS, CSP, X-Content-Type-Options, X-Frame-Options). The parsing happens in the page, which is also why it cannot see a live response - no connection is opened, so you copy the headers out of curl, the network panel or a log and paste them here.
How to use it
- Copy a raw request or response, request line or status line first; the default box holds GET / HTTP/1.1 and Host: example.com.
- Press Process.
- Read the per-header breakdown and the === Summary === block at the end; Copy Output takes the whole report.
Worked example
GET / HTTP/1.1
Host: example.combecomesRequest line: GET / HTTP/1.1
Host:
Category: Request routing
Meaning: Domain + optional port the client is connecting to (required in HTTP/1.1).
Value: example.com
=== Summary ===
Headers analyzed: 1 (0 unknown/non-standard, 0 security-related)
Recommended security headers missing:
✗ strict-transport-security (HSTS)
✗ content-security-policy (CSP)
✗ x-content-type-options (nosniff)
✗ x-frame-options (frame protection)The tool reads the leading GET, so line one is reported as the request line and is not counted as a header.
HTTP/1.1 200 OK
Strict-Transport-Security: max-age=31536000
Content-Security-Policy: default-src 'self'
X-Content-Type-Options: nosniff
X-Frame-Options: DENYbecomesStatus line: HTTP/1.1 200 OK
Strict-Transport-Security:
Category: Security
Meaning: HSTS: forces HTTPS for this host for max-age seconds, optionally incl. subdomains.
Value: max-age=31536000
Content-Security-Policy:
Category: Security
Meaning: CSP: controls which resources may load — the strongest XSS mitigation.
Value: default-src 'self'
X-Content-Type-Options:
Category: Security
Meaning: nosniff stops MIME-type sniffing of declared content types.
Value: nosniff
X-Frame-Options:
Category: Security
Meaning: Legacy clickjacking protection: DENY or SAMEORIGIN (superseded by CSP frame-ancestors).
Value: DENY
=== Summary ===
Headers analyzed: 4 (0 unknown/non-standard, 4 security-related)
Recommended security headers missing:
✓ all key security headers presentOnly the headers you actually paste are judged, so this green result says nothing about any site other than the one the dump came from.
When to use it
- Making sense of a curl -I dump someone sent you, before you trust their claim about security headers.
- Working out why a cross-origin fetch is blocked by reading the Access-Control-Allow-Origin line.
- Learning what Cache-Control, Vary or Retry-After really control, one header at a time.
What it does not do
- Nothing is fetched. You cannot type a URL and see its headers, because this site makes no network requests at all.
- The built-in table covers about 30 names, so genuine vendor headers such as X-Request-Id are reported as unknown.
- Values over 100 characters are truncated, and folded continuation lines are printed as separate lines that fail the header check.
- The security summary tests four headers only, so a clean result is a narrow statement rather than an audit.
- Every line is counted, including duplicates, so the totals describe lines rather than unique headers.