HTTP headers analyzer
Paste the headers of an HTTP response to see what each one does, the security grade and what is missing, with caching and cookies explained.
How to useAnalyze HTTP headers.
Available in: 
HTTP headers analyzer: what it is for
Paste the headers of an HTTP response (from DevTools or curl -I) and see what each one is for, a security grade from A to F with the missing headers (HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy and Permissions-Policy), the cache time in plain language, cookie protections and the information the server is exposing.
Everything runs in your browser: nothing you paste or open is sent to a server.
How to use
- Copy the response headers.
- Paste them here and see the grade.
- Add the missing headers.
When to use it
- Review a site's security.
- Check cache and CDN rules.
- Explain headers to your team.
Frequently asked questions
How do I copy a site's headers?
In Chrome, open DevTools (F12), go to Network, reload the page, click the first request and copy the response headers. In the terminal, use curl -I https://yoursite.com.
Which security headers matter most?
Strict-Transport-Security (forces HTTPS), Content-Security-Policy (limits where scripts come from), X-Content-Type-Options, X-Frame-Options or frame-ancestors (keeps the site out of other people's iframes), Referrer-Policy and Permissions-Policy.
Is the grade the same as other tests?
It is a simple grade, similar to securityheaders.com: each security header present adds points. It is meant to show quickly what is missing.
Is it really free?
Yes, 100% free. No sign-up, no subscription and no usage limits. All Tools123 are free.