HTTP Header Analyzer: Audit Response Headers for Security Gaps
Response headers carry a surprising amount of a site's security posture — whether HTTPS is enforced, whether the page can be framed by another site, whether a Content Security Policy is restricting script sources. This tool parses raw response headers you paste in and checks them against the small set of security headers most security baselines recommend for every public-facing site.
Checks for HSTS, X-Content-Type-Options, X-Frame-Options, CSP, Referrer-Policy, and Permissions-Policy.
Why These Six Headers Specifically
Strict-Transport-Security, X-Content-Type-Options, X-Frame-Options, Content-Security-Policy, Referrer-Policy, and Permissions-Policy appear consistently across security baselines like the OWASP Secure Headers Project and Mozilla's HTTP Observatory scoring — they're relatively cheap to add and address distinct, common attack vectors: protocol downgrade, MIME confusion, clickjacking, script injection, information leakage, and unwanted feature access.
Reading Headers From a Live Site
Since browsers restrict client-side JavaScript from freely reading arbitrary cross-origin response headers, this tool works from headers you've already captured — via your browser's Network tab (click any request, open the Headers panel) or curl -I https://example.com, which prints just the response headers without downloading the body.
Security Headers Are One Layer, Not the Whole Picture
Missing security headers are a real, actionable gap, but they're one layer of defense among many — proper input validation, authentication, and dependency hygiene matter more for most real-world breaches. Treat a clean header report as one good sign, not a complete security audit.
Practical Examples
Auditing a Production Site
Checking headers after a deploy.
- 1.curl -I https://example.com
- 2.Paste the output here
- 3.Review which of the 6 security headers are present
Debugging a Missing HSTS Header
A common oversight after adding HTTPS.
- 1.Header report shows: strict-transport-security missing
- 2.Add: Strict-Transport-Security: max-age=31536000; includeSubDomains
Security Headers Checked
- Strict-Transport-Security: enforce HTTPS
- X-Content-Type-Options: prevent MIME sniffing
- X-Frame-Options: prevent clickjacking
- Content-Security-Policy: restrict resource sources
- Referrer-Policy: control referrer leakage
- Permissions-Policy: restrict browser features
Good Use Cases
- Post-deploy security header audit
- Comparing header configuration across environments
- Debugging why a security scanner flagged missing headers
- Learning what each security header actually protects against
Frequently Asked Questions
Where do I get raw response headers to paste in?
Your browser's DevTools Network tab shows response headers for any request — click a request and look at the Headers panel. curl -I
Why does this only check a handful of security headers?
These six (HSTS, X-Content-Type-Options, X-Frame-Options, CSP, Referrer-Policy, Permissions-Policy) are the headers most commonly recommended by security baselines like the OWASP Secure Headers Project and Mozilla Observatory, covering the highest-value, broadly-applicable protections rather than every possible header.
Is a missing security header always a real problem?
Not necessarily — context matters. An internal admin tool behind a VPN has different risk than a public-facing site. But for public-facing production sites, these headers are inexpensive to add and meaningfully reduce common attack surface (clickjacking, MIME-sniffing, XSS via CSP).
Does this tool fetch headers from a live URL?
No — since browsers block client-side JavaScript from reading many response headers of arbitrary cross-origin requests (CORS), this tool has you paste headers you've already captured (from DevTools or curl) rather than trying to fetch them itself.
What's the difference between this and the HTTP Headers Generator?
This tool analyzes headers you already have, checking what's present or missing. The HTTP Headers Generator builds a recommended header set from scratch via toggles — use the analyzer to audit, the generator to build.
Is my pasted header data sent anywhere?
No, parsing and analysis both happen entirely in your browser via text parsing — no upload.