HTTP Header Analyzer
Analyze HTTP response headers for security and performance.
How to Copy Headers
F12 or Ctrl+Shift+I on the website you want to analyze.
Network tab and refresh the page.
Headers tab, find Response Headers section and copy all.
Security Score
Headers analyzed to calculate score
Security Headers
💾 Caching
📄 Content
📋 All Headers (0)
Practical Example
Copy Response Headers from the browser Network panel and paste them here to inspect HSTS, CSP, CORS, and caching settings. It is useful after deploying a static site through a CDN or hosting provider.
What is HTTP Header Analysis?
HTTP response headers are metadata sent by web servers to clients, containing security policies, caching configurations, content types, and CORS settings. Properly configured security headers prevent XSS, clickjacking, and MIME sniffing attacks. Optimized caching headers improve page load performance.
This tool parses pasted HTTP response headers to analyze security headers, caching, and content settings, and calculates a security score. All analysis runs in your browser — no data is sent to any server.
Key Security Headers
HSTS (Strict-Transport-Security) forces browsers to use HTTPS, preventing man-in-the-middle attacks. max-age specifies the duration (in seconds) for HTTPS enforcement. includeSubDomains extends coverage to subdomains.
CSP (Content-Security-Policy) restricts which resources can be loaded on a page, preventing XSS attacks. Directives like default-src, script-src, and style-src provide granular control. For example, script-src 'self' only allows scripts from the same origin.
X-Frame-Options prevents your page from being loaded in an <iframe>, blocking clickjacking attacks. DENY blocks all embedding; SAMEORIGIN allows same-origin only.
X-Content-Type-Options set to nosniff prevents browsers from guessing MIME types, blocking attacks where malicious scripts disguise as images.
Referrer-Policy controls how much referrer information is sent when navigating to other sites. strict-origin-when-cross-origin is generally recommended.
Practical Use Cases
Pre-launch Security Check — Verify HSTS, CSP, X-Frame-Options, and other essential security headers are configured before launching a new service.
Cache Configuration Audit — Verify Cache-Control, ETag, and Expires headers are set as intended to reduce unnecessary server requests and improve loading performance.
Security Audits — Periodically check security headers to respond to new vulnerabilities and verify headers haven't been inadvertently changed after updates.
CORS Debugging — Verify Access-Control-Allow-Origin and related CORS headers are correctly configured to resolve cross-origin request errors.
Recommended Starting Values for the Five Security Headers
Practical starting values for the security headers this tool flags as missing. Safe as-is for most static sites.
| Header | Starting value | Protects against |
|---|---|---|
| Strict-Transport-Security | max-age=31536000; includeSubDomains | Forces HTTPS, blocks downgrade attacks |
| X-Content-Type-Options | nosniff | Script execution via MIME sniffing |
| Referrer-Policy | strict-origin-when-cross-origin | URL leakage to external links |
| Content-Security-Policy | Needs per-site design (see below) | XSS, unauthorized resource loading |
| Permissions-Policy | camera=(), microphone=(), geolocation=() | Unneeded browser permissions |
CSP is the one header where copy-paste fails: every external CDN, ad and analytics domain must be allow-listed. The safe rollout is Content-Security-Policy-Report-Only first, collect violation reports, then switch to enforcement. Per-header behavior is covered in the HTTP headers guide.
FAQ
Is the security score an absolute standard?
No. It is a relative score based on general best practices (OWASP guidelines). Requirements vary by service type — a static CDN site may need simpler CSP than a web app handling user input.
Where do I copy headers from?
Open browser DevTools (F12), go to the Network tab, refresh the page, click the first request (usually the domain name), and copy the Response Headers section. See the step-by-step guide at the top of the page.
Why is HSTS important?
HSTS forces HTTPS connections, preventing SSL stripping attacks where an attacker downgrades connections to HTTP. Once set, browsers automatically upgrade to HTTPS for the max-age duration.
What does CSP prevent?
CSP restricts which resources can execute on your page, primarily preventing XSS (Cross-Site Scripting). For example, script-src 'self' only allows scripts from your own domain. Adding 'unsafe-inline' weakens this protection but may be needed for inline scripts.
Are pasted headers sent to a server?
No. All analysis runs in your browser using JavaScript. No network requests are made — verify in your DevTools Network tab.
How do I configure security headers?
Security headers are added via web server configuration (Nginx: add_header, Apache: Header set) or CDN settings (e.g., Cloudflare dashboard). Refer to your server documentation for specific syntax.