HTTP Header Analyzer
Inspect response headers and security header coverage
What is HTTP Header Analyzer?
This HTTP header analyzer fetches the response headers for a URL and checks six key security headers one by one (HSTS, CSP, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, and Permissions-Policy), offering a concrete recommendation for anything missing. Browsers cannot read cross-origin response headers, so the request is made by this site's server on your behalf.
How to use HTTP Header Analyzer
- 1Enter the target URL and click Analyze.
- 2Review the security header results; every missing header comes with a suggested configuration.
- 3The full set of response headers is listed on the right and can be copied.
- 4Note that redirects are not followed, so you see the original 301 or 302 response.
Frequently asked questions
Which of these six security headers should I add first?+
Order them by effort against payoff. Start with X-Content-Type-Options: nosniff and Referrer-Policy, which are one line each with no side effects. Add HSTS next, once you have confirmed HTTPS works across the whole site. Leave CSP for last: it is by far the most effective header, but it has to be tuned rule by rule for each site, and rushing it into production is the quickest way to block your own scripts.
Why does this tool not follow redirects?+
Because the redirect response itself is usually what you are investigating: whether HSTS is returned on the 301, whether Location is correct, whether there is an unnecessary extra hop. Following the redirect would show you only the headers of the final destination and would hide exactly the information you came for.
Could the target site treat this as an attack?+
It sends a single ordinary GET request with an identifiable User-Agent, no different from one visit in a browser. The server also applies rate limiting and refuses targets that point at private network addresses.
Related tools
All toolsHTTP Status Codes
HTTP status code reference with likely causes and where to look
URL Parser
Break a URL into its components and query parameters
MIME Type Lookup
MIME type and file extension reference
User Agent Parser
Parse a User-Agent string into browser and OS details
CIDR Subnet Calculator
CIDR subnet calculator with membership checks
DNS Lookup
DNS record lookup across 8 record types