HTTP Header Analyzer
Attach HTTP Request / Response Header to instantly analyze the structure, security, cache settings, CORS configuration and cookie security.
Suitable for web development, API debugging and security analysis.
HTTP Header FAQ
Q1: What is HTTP Header?
HTTP Header is the metadata in HTTP requests and responses, located after the start line and before the message body, ending with Header-Name: Value Format presentation. Header conveys additional information about the request, response or connection, such as content type, cache policy, authentication information, security settings, etc.
Example:Content-Type: text/html; charset=utf-8
Cache-Control: public, max-age=3600
X-Frame-Options: DENY
Q2: What is the difference between Request Header and Response Header?
Request Header Sent by the client to the server, including Host, User-Agent, Accept, Authorization, Cookie, etc.Response Header Sent by the server to the client, including Content-Type, Cache-Control, Set-Cookie, Strict-Transport-Security, etc.
Q3: What are Security Headers? Why is it important?
Security Headers It is a header used in HTTP Response Header to enhance website security, such as HSTS (mandatory HTTPS), CSP (anti-XSS), X-Frame-Options (anti-Clickjacking), etc. OWASP recommends that all production environment websites configure these headers.
Q4: What is CORS? Why do you need to set CORS Headers?
CORS (Cross-Origin Resource Sharing) It is a browser security mechanism that allows web pages to request resources from one domain to another. Related headers include Access-Control-Allow-Origin、Allow-Methods、Allow-Headers、Allow-Credentials、Max-Age. Frequently Asked Questions: Using * Pairing credentials=true will fail.
Q5: What is the difference between Cache-Control and Expires?
Expires Is an HTTP/1.0 header that specifies an expiration time using an absolute time.Cache-Control is an HTTP/1.1 header that provides finer cache control (e.g. max-age、public、no-store). Modern websites should use Cache-Control first, and can also set Expires as fallback.
Q6: What do Cookie's Secure, HttpOnly, and SameSite do?
Secure: Cookies are only sent under HTTPS.HttpOnly: Disable JavaScript access (to prevent XSS theft).SameSite: Control cross-site request behavior (Strict/Lax/None). Best practice: Sensitive cookies should be set to all three.
Q7: Will this tool upload my Header information to the server?
Not at all. This tool isPure front-end application, all parsing and analysis is done locally in your browser.
A Complete Guide to HTTP Headers
HTTP message structure
A complete HTTP message consists of three parts:
GET /api/users HTTP/1.1 or HTTP/1.1 200 OK
Headers
Host: api.example.com
Content-Type: application/json
(blank line)
Message body (Body) — optional
Headers are located after the starting line and before the empty line, one line per Header. Correctly configuring headers is critical for security, performance, and SEO.
Security Score scoring criteria
- HSTS（+20）: Force HTTPS, prevent SSL Stripping
- CSP（+20）: Content security policy to prevent XSS
- X-Frame-Options（+12）: Prevent clickjacking
- X-Content-Type-Options（+10）: Prevent MIME sniffing
- Referrer-Policy（+10）: Control Referer exposure
- Permissions-Policy（+10）: Restrict API access
- CORS correctly configured (+8)、Content-Type（+5）、Cookie security (+5)
Out of 100 points, 80+ Excellent · 60+ Good · 40+ Fair · Below 40 Poor.