HTTP Header Analyzer

Every HTTP request and response carries a block of headers that control caching, security, cross-origin access, and how the body should be interpreted — but reading them cold is tedious, and it's easy to miss a security header that should be there but isn't. The HTTP Header Analyzer parses a pasted block of raw headers and turns it into a categorized breakdown: which headers are present, what each one does, and which common security headers are missing.

It is built for anyone debugging a caching problem, auditing a site's security posture, checking why a CORS request fails, or just trying to understand what a server sent back.

How to use it

1. Capture the headers you want to inspect — from your browser's Network tab (right-click a request → Copy → Copy request/response headers), from curl -I or curl -sD -, or from any raw HTTP trace.
2. Paste the block into the input box. An optional leading status line (HTTP/1.1 200 OK, HTTP/2 200) or request line (GET /path HTTP/1.1) is recognized and skipped; every other line is parsed as Header-Name: value.
3. The analysis updates as you type.

The output is split into three sections:

• Summary — the status line (if present), a total header count, a count per category, a count of custom/non-standard headers, and a list of common security headers that are missing.
• Header Breakdown — every parsed header with its category and a one-line explanation of what it does.
• JSON Export — the same analysis as structured JSON (headers, per-header category/description, and the summary), ready to copy or download.

Header names are matched case-insensitively, and headers that legitimately repeat — most commonly Set-Cookie — are kept together with all of their values rather than collapsed into one.

How are headers categorized?

• Security — Strict-Transport-Security, Content-Security-Policy, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy, and related headers that harden the browser's handling of the response.
• Caching — Cache-Control, Expires, ETag, Last-Modified, Vary, Age, and conditional-request headers.
• CORS — the Access-Control-* family and Origin.
• Content — Content-Type, Content-Encoding, Content-Length, and other headers describing the body itself.
• Custom — everything else, including non-standard X-* headers, server-identifying headers like Server/X-Powered-By, and cookies. Landing here isn't a problem — it just isn't one of the four standard groups above.

Which security headers does it check for?

The summary flags any of Strict-Transport-Security, Content-Security-Policy, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, or Permissions-Policy that aren't present. Missing headers aren't necessarily a bug — a JSON API has little use for X-Frame-Options — but the list is a useful checklist for a public-facing HTML response.

Can I paste a request instead of a response?

Yes — request headers (Cookie, Authorization, Host, CORS preflight headers, etc.) are parsed and categorized the same way as response headers.

Does this tool fetch a URL for me?

No — it only analyzes headers you paste in and never makes a network request, so it also works with headers from private/internal services that aren't publicly reachable.

Privacy

All parsing happens entirely in your browser. The headers you paste are never uploaded, logged, or sent anywhere.