Audit a web response
Quickly identify missing or incomplete HTTP protections.
HTTP Header Analyzer
Inspect a set of HTTP headers and get a readable report covering security directives, caching, CORS, and detected cookie settings.
- Clipboard
- Export
Paste HTTP response lines, with or without the status line.
Data not sent
Processing…0 %
Analysis report
Was this tool useful?
How does this tool work?
Analyze HTTP headers and receive a report about security, caching, CORS, and cookies.
Paste response headers as one Name: value field per line. A status line such as HTTP/1.1 200 OK is ignored. Names are lowercased and checked, and repeated values are joined with commas. Set-Cookie remains on separate lines because Expires can contain a comma. HTTP/2 pseudo-headers such as :status are not accepted by this interface.
The report checks the presence of Content-Security-Policy, Strict-Transport-Security, X-Content-Type-Options, Referrer-Policy and Permissions-Policy. It also examines Cache-Control, Access-Control-Allow-Origin and Content-Encoding. The percentage uses an internal scale: 12 points per one of those five fields, 8 for caching, 6 for an explicit CORS origin, 6 for compression and up to 12 for cookie attributes, divided by a maximum of 92. This is not an externally certified rating.
Secure, HttpOnly and recognized SameSite values are checked separately for each cookie. An attribute scores only when every cookie has it. Relationships between directives are not validated: SameSite=None without Secure, ineffective CSP or invalid HSTS can still earn presence points. Some fields are unnecessary for particular responses. A maximum score is therefore not a security assessment, and a low score does not demonstrate a vulnerability.
How to use this tool
Copy one real response
Obtain headers from browser network tools or an HTTP client. Remove the body and intermediate responses so you inspect one response at a time.
Run the local inspection
Paste and analyze the lines. The tool does not fetch the site or confirm that every user receives these headers.
Interpret individual findings
Check each directive’s meaning in context. Compare responses after server changes, distinguishing field presence from effective values.
Use cases
Check a CDN setup
Review caching, compression, and proxy-added headers.
Inspect cookies
Detect Secure, HttpOnly, and SameSite attributes.
Examples
Presence does not validate a value
The CSP field earns 12 out of 92 points, rounded to 13%. The dummy invalid-policy value is not recommended and is not validated by this counter.
Input
Content-Security-Policy: invalid-policyResult
13%Split attributes do not accumulate
Both cookies have SameSite, but not both have Secure and HttpOnly. Only SameSite earns 4 out of 92 points, rounded to 4%.
Input
Set-Cookie: a=1; Secure; HttpOnly; SameSite=Lax
Set-Cookie: b=2; SameSite=LaxResult
4%Tips and best practices
- Do not publish real Set-Cookie or authentication values in tickets. Local analysis does not protect text you later share elsewhere.
- Static responses, public APIs and authenticated pages have different caching and CORS needs. Interpret the report for the resource in question.
- Do not combine redirect and final-response headers: that creates a policy set belonging to neither response.
Sources and references
- RFC 9110 — HTTP Semantics (opens in a new tab), RFC EditorPage in English
Frequently asked questions
Does the tool visit my site?
No. It only analyzes pasted text. It does not test redirects, TLS or policies during an actual page load.
Does 100% guarantee good security?
No. It represents presence and attribute checks on this internal scale. It neither validates complete policy semantics nor searches for application vulnerabilities.
Why can missing CORS be acceptable?
A resource not intended for cross-origin reading may not advertise CORS. Allowed origins must reflect intended usage and authentication mode.
How are several cookies evaluated?
Each line keeps its own attributes. Secure, HttpOnly or SameSite scores only when all cookies have that attribute; values are not merged into an imaginary cookie.
Related tools
Keep going with these tools
Tools similar or complementary to this one.
Similar tools
Build custom HTTP headers and get output ready to use in your requests.
DevelopmentUse this tool
Build a complete HTTP API request with method, URL, parameters, headers, and body.
DevelopmentUse this tool
Find a MIME type from an extension or the other way around.
DevelopmentUse this tool
Read next
GuideBest practicesBeginner
HTTP security headers: which ones to enable and why
Understand HSTS, CSP, X-Content-Type-Options, Referrer-Policy and Permissions-Policy and how to verify the headers actually returned.
29 August 20261 min
GuideConcepts and technologiesIntermediate
ISO week, Unix timestamp and dates in computing: understanding time representations
Understand ISO 8601 week numbers, Unix timestamps in seconds or milliseconds, and the difference between human-readable dates and technical time values.
28 August 20264 min