Quick Answer
HTTP response headers carry metadata about a web response — content type, caching rules, and security policies. This tool parses headers you paste in and flags whether key security headers (HSTS, X-Frame-Options, X-Content-Type-Options) are present.
How to use this tool
- Get the raw response headers for a site — e.g. from your browser's DevTools Network tab, or a command like
curl -I https://example.com.
- Paste them in, one header per line, in
Name: value format.
- Click Analyze Headers to see them parsed and checked against common security best practices.
What the security checks mean
- Strict-Transport-Security (HSTS) — tells browsers to always use HTTPS for this domain, preventing downgrade attacks.
- X-Frame-Options — prevents the page from being embedded in an iframe on another site (clickjacking protection).
- X-Content-Type-Options: nosniff — stops browsers from guessing a file's MIME type in a way that could enable attacks.
Privacy
Parsing and analysis happen entirely in your browser. The headers you paste are never sent to any server.
FAQ
Does this tool fetch headers from a live URL?
No — you paste headers you've already captured (e.g. via DevTools or curl). This keeps the tool simple and avoids any server-side request on your behalf.
Related Tools