Paste HTTP response headers to get security scores, cache analysis, and recommendations.
Paste HTTP response headers above and click Analyze Headers
to get security scores and recommendations.
HTTP Header Analyzer parses HTTP request and response headers and explains each one: its purpose, typical values, security implications, and whether it follows best practices. Paste headers from curl, browser DevTools, or an HTTP client — the tool groups headers by category (caching, security, content, CORS, cookies) and highlights missing security headers, deprecated headers, and misconfigured values.
HTTP headers are metadata attached to every request and response. Request headers carry browser capabilities, authentication tokens, caching preferences, and desired content types. Response headers control caching (Cache-Control, ETag), security policies (CSP, HSTS, X-Frame-Options), content encoding (Content-Encoding, Content-Type), and CORS permissions. Understanding headers is essential for debugging API issues, performance optimization, and security hardening.
Critical security response headers to check: Strict-Transport-Security (HSTS): forces HTTPS. Content-Security-Policy: prevents XSS. X-Content-Type-Options: nosniff prevents MIME sniffing. X-Frame-Options: DENY prevents clickjacking. Permissions-Policy: restricts access to browser APIs. Referrer-Policy: controls referer header sending. Missing any of these on a production site is a common security audit finding.
Analyze security headers
Result: Missing headers found: HSTS, Content-Security-Policy, Permissions-Policy → security score: 40/100
Check CORS configuration
Result: Access-Control-Allow-Origin: * detected → WARNING for APIs handling authentication
Inspect caching setup
Result: Cache-Control: max-age=0, no-store → not cached / Etag present → conditional requests work
What security headers should every website have?
Minimum security header set: (1) Strict-Transport-Security: max-age=31536000; includeSubDomains (HTTPS only). (2) X-Content-Type-Options: nosniff. (3) X-Frame-Options: DENY (or use CSP frame-ancestors). (4) Referrer-Policy: strict-origin-when-cross-origin. (5) Content-Security-Policy: at minimum default-src 'self'. (6) Permissions-Policy restricting camera, microphone, geolocation if not needed. Test at securityheaders.com.
What is HSTS and why is it important?
HTTP Strict Transport Security (HSTS) tells browsers that this site should only be accessed over HTTPS — ever. After receiving HSTS, browsers automatically upgrade HTTP requests to HTTPS and refuse to connect if the certificate is invalid (no 'proceed anyway' option). The preload list (submit at hstspreload.org) includes sites that browsers hardcode as HTTPS-only, protecting even first-time visitors. Requirement: serve over HTTPS for at least 1 year (max-age=31536000).
What does X-Content-Type-Options: nosniff do?
Browsers normally try to detect the content type by examining file content (MIME sniffing) even if the Content-Type header specifies otherwise. This can be exploited: an attacker uploads a file that appears to be an image but contains HTML/JS; the browser detects and executes it. nosniff tells browsers to trust the Content-Type header exactly — if a file is served as image/png, it's treated as an image, never as HTML or script. Always include this header on file upload endpoints.
What is the Referrer-Policy header?
Referrer-Policy controls what URL is included in the Referer header when users navigate from your site to others. no-referrer: never send referer. no-referrer-when-downgrade: send full URL for HTTPS→HTTPS, nothing for HTTPS→HTTP. origin: send only the origin (https://example.com, not the full path). strict-origin-when-cross-origin (recommended): send full URL for same-origin, only origin for cross-origin HTTPS, nothing for HTTP. This prevents leaking sensitive URL parameters (passwords in reset links, token in URLs) to third parties.
What is the Permissions-Policy header?
Permissions-Policy (formerly Feature-Policy) controls which browser APIs and features your site can use and whether they can be used in embedded iframes. Restrict features you don't use: Permissions-Policy: camera=(), microphone=(), geolocation=(), payment=() disables access to these APIs entirely on your site. This limits damage if an attacker injects a malicious script — even injected code can't access the camera or payment APIs. Each permission can be allowed for specific origins: camera=(self https://trusted.com).