HTTP Header Analyzer
Inspect raw HTTP response headers for CORS conflicts, cache behavior, cookie flags, common browser security controls, and unnecessary technology disclosure. Everything runs in this browser tab.
Processed locally · No upload · No request is sent to the inspected server
How to use it
- Copy the response status line and headers from a browser network panel,
curl -I, or an HTTP client. - Paste the text, drop a local text file, or load the built-in example.
- Select Analyze headers or press Ctrl/⌘ + Enter.
- Resolve errors first, then review warnings in the context of the endpoint and its clients.
What the analyzer checks
The parser treats header names case-insensitively, preserves repeated fields, and accepts an optional HTTP status line. It reports malformed lines and conflicting Content-Length values as errors. Multiple content lengths can make intermediaries disagree about message boundaries, so an unexpected conflict should be investigated at the application, proxy, and edge layers.
CORS checks flag the invalid combination of wildcard Access-Control-Allow-Origin and credentialed access. When a response selects a specific origin, the analyzer recommends Vary: Origin so shared caches do not reuse a response for the wrong requesting origin. This is a focused response-header check; it cannot know whether the preflight request, allowed methods, or allowed headers match the browser request.
Cookies and browser security headers
Every Set-Cookie field is checked for Secure, HttpOnly, and a recognized SameSite value. These flags reduce common transport, script-access, and cross-site request risks, but the right cookie scope still depends on the application. Review Domain, Path, lifetime, prefixes, and whether a cookie must be available to client-side JavaScript.
The report also looks for X-Content-Type-Options: nosniff, Content Security Policy, frame protection, and Referrer Policy. A CSP with frame-ancestors can provide modern frame protection without X-Frame-Options. Policy values are not scored because a header can exist yet remain too broad for the application. Test the actual policy in the browsers and embedding contexts you support.
Cache and disclosure notes
Cache-Control and Content-Type are included as informational notes so they stay visible in a copied report. Their correctness depends on the resource: public hashed assets can use a long immutable lifetime, while personalized HTML or private API responses need more restrictive rules. Verify behavior at every cache layer, including the browser, CDN, reverse proxy, and application.
Server and X-Powered-By values receive warnings because they expose implementation details that rarely help a client. Removing them does not fix a vulnerable dependency, but it reduces unnecessary fingerprinting. Prefer removing the fields at their shared origin rather than adding different filters at every route.
Limits and safe debugging
This tool analyzes text; it does not fetch a URL, test TLS, execute redirects, inspect the response body, or prove that an endpoint is secure. It cannot evaluate authorization, session handling, HSTS preload eligibility, CSP directive quality, proxy normalization, or request-smuggling resistance. Use the output as a review checklist, then verify the real response path with browser developer tools and a controlled HTTP client.
Headers can contain session cookies, bearer credentials, internal hostnames, and infrastructure identifiers. Redact sensitive values before sharing a downloaded report. For a broader investigation, follow the API Debugging Toolkit; use cURL to Fetch when comparing request semantics and the OpenAPI tools when checking the documented contract.
Frequently Asked Questions
Does the analyzer request the URL or contact my server?
No. It only reads the header text pasted into the browser and makes no request to the target server.
Does a clean report prove that a response is secure?
No. The report covers common header signals, not application authorization, content safety, TLS configuration, or every browser policy.
Can I analyze request headers?
You can parse them, but security and cache recommendations are primarily designed for HTTP response headers.