HTTP Header Analyzer

The HTTP Header Analyzer provides comprehensive analysis of HTTP response headers returned by web servers, diagnosing security, caching strategy, authentication protection, and CORS configuration in one tool. Simply copy HTTP response headers from browser DevTools, curl, or your API and paste them to instantly receive a security score (0-100), specific recommendations for missing headers, and cache optimization advice.

Security Diagnosis checks 7 critical security headers aligned with OWASP guidelines. Strict-Transport-Security (HSTS) enforces HTTPS to prevent protocol downgrade attacks; Content-Security-Policy (CSP) blocks XSS and injection attacks; X-Content-Type-Options prevents MIME type sniffing; X-Frame-Options prevents clickjacking; Referrer-Policy restricts referrer leakage; Permissions-Policy controls browser capabilities (camera, microphone). For missing headers, the tool provides concrete configuration examples for common server environments, making implementation straightforward.

Cache Analysis explains each Cache-Control directive in detail. max-age specifies freshness in seconds; no-store forbids all caching; no-cache requires validation before reuse; must-revalidate enforces validation after expiration; immutable marks resources as never-changing. The tool clearly shows how each directive affects actual browser and CDN caching behavior. It detects Expires, ETag, and Last-Modified headers to identify 304 Not Modified optimization opportunities for bandwidth savings.

Cookie Security Verification individually checks three critical Set-Cookie flags. Missing Secure flag risks HTTP transmission and eavesdropping; missing HttpOnly flag risks XSS-based JavaScript access; missing SameSite flag risks CSRF attacks. The tool displays recommended values (HttpOnly=required, Secure=required for HTTPS, SameSite=Strict/Lax preferred) for each flag.

CORS Validation analyzes Access-Control-Allow-Origin, Allow-Methods, and Allow-Credentials settings. It highlights the critical misconfiguration of "Allow-Origin: * with credentials: true" in red, warning of auth token leakage. It emphasizes wildcard (*) risks and recommends migrating to explicit origin allowlists (e.g., https://trusted-domain.com).

Warning Header Detection identifies security-risk headers. X-Powered-By (reveals Express, Tomcat, etc.) and Server headers (Apache, nginx) give attackers vulnerability research footholds and should be removed. X-UA-Compatible (IE compatibility mode) is deprecated and useless on modern browsers, recommended for removal.

All processing occurs entirely in your browser (client-side), so sensitive header information is never transmitted to any server, ensuring safe analysis of confidential system headers.