HTTP header analyzer

What is a Http Header Analyzer?

HTTP response headers control security, caching and cross-origin behaviour of a website. Missing or misconfigured headers leave sites open to clickjacking, protocol downgrade and cross-site scripting, or cause stale and uncacheable content. This analyzer parses raw response headers and flags common problems.

How to get the headers

  • Browser: open developer tools, Network tab, select the document request and copy the response headers.
  • Terminal: curl -sI https://example.com

How to use it

  1. Paste the raw response headers.
  2. Review the findings for security, caching and CORS headers.
  3. Fix issues in your server, CDN or framework configuration and re-check.

Security headers to look for

  • Strict-Transport-Security: forces HTTPS, for example max-age=31536000; includeSubDomains.
  • Content-Security-Policy: restricts where scripts and other resources load from.
  • X-Content-Type-Options: nosniff: stops MIME type sniffing.
  • X-Frame-Options or CSP frame-ancestors: prevents clickjacking.
  • Referrer-Policy: limits URL leakage, for example strict-origin-when-cross-origin.
  • Set-Cookie with Secure, HttpOnly and SameSite.

Headers that leak information

Server: Apache/2.4.41 (Ubuntu) and X-Powered-By: PHP/7.4 tell attackers exact versions to target. Remove or genericise them.

Caching and CORS

  • Cache-Control should be long and immutable for fingerprinted assets, and short or no-cache for HTML.
  • Access-Control-Allow-Origin: * combined with credentials is invalid and should be reviewed.

Frequently Asked Questions

How do I see a site's response headers?

Use your browser's developer tools Network tab, or run curl -I with the URL in a terminal.

Which security headers are most important?

Strict-Transport-Security, Content-Security-Policy, X-Content-Type-Options, frame protection and a Referrer-Policy.

Why should I hide the Server header version?

Exact software versions help attackers find known vulnerabilities to exploit.

Is X-XSS-Protection still needed?

No. Modern browsers have removed the XSS auditor. Use a Content-Security-Policy instead.

Are my headers sent anywhere?

No. The headers are parsed and analysed entirely in your browser.

What Cache-Control should HTML pages use?

Usually a short max-age or no-cache with revalidation, so users get updates quickly, while fingerprinted assets can be cached for a year.

You May Also Need