Free HTTP Headers Analyzer
Analyze pasted HTTP headers for caching, common security directives, CORS, cookies and duplicate fields. Review multiple blocks and export reports with optional credential redaction.
Loading tool…
How to analyze HTTP response headers without a live scan
Paste raw HTTP headers or a JSON header object to review caching, security directives, CORS and cookie attributes locally. Export a report without fetching a website.
- Copy response headers from browser developer tools or cURL, then paste them or import a small text file.
- Choose Analyze headers and select a response block when the input contains redirects or multiple responses.
- Set the response context, browser or shared-cache audience and evaluation time in UTC. Review findings and cookie attributes.
- Keep recognized-secret redaction enabled when appropriate, review the output and copy or download the report.
When to analyze headers you already have
HTTP headers control how responses are cached, which origins can read them and how cookies behave. A developer debugging a stale page, a site owner reviewing a CDN change, or a security reviewer preparing a report can all use this tool on headers copied from browser developer tools or a cURL command.
Because it works only on pasted text, it is useful for staging servers, internal services and saved logs that a public scanner cannot reach. You can paste a redirect chain and review each response block separately, or paste a JSON object of header names and values exported from another tool.
Worked example: cache freshness
Paste this response: HTTP/2 200, Date: Thu, 29 Oct 2026 12:00:00 GMT, Age: 30, Cache-Control: public, max-age=600, s-maxage=3600, Content-Type: application/json, X-Content-Type-Options: nosniff and Set-Cookie: sid=abc; Path=/; HttpOnly. Set the context to API and the evaluation time to 2026-10-29 12:02:00 UTC.
The estimated age is the larger of the Age value, 30 seconds, and the time since the Date header, 120 seconds, so it is 120 seconds. For a browser cache, the lifetime is max-age, 600 seconds, which leaves 480 seconds of freshness. Switch the audience to CDN or shared cache and the lifetime becomes s-maxage, 3600 seconds, which leaves 3480 seconds.
The cookie panel notes that Secure is absent and SameSite is not explicit. A Shared caching and cookies warning also appears, because the response is public and sets a cookie.
How the findings are produced
The parser splits input into blocks at each status line, such as HTTP/1.1 301, and reads one header per line. It ignores cURL diagnostic lines and anything after a blank line that follows headers, with a warning. Header names are matched without regard to case.
For HTML documents, it looks for an enforcing Content-Security-Policy, framing control through frame-ancestors or X-Frame-Options, and a Referrer-Policy. For every response it checks X-Content-Type-Options, HSTS max-age and CORS rules. One example: Access-Control-Allow-Origin set to an asterisk cannot be combined with credentials. Each finding is labeled Present, Review or Info.
Common mistakes to avoid
Do not paste request headers and expect response checks. A block that starts with a request line, such as GET / HTTP/1.1, is treated as a request, and response checks are skipped. Copy the response section from your developer tools instead.
Leave out the Date header and the tool cannot estimate how old a response is. Also be careful when sharing reports. Redaction hides values for recognized names such as Authorization, Cookie, Set-Cookie and token fields, but custom headers may still contain secrets. Review the export before sending it to anyone.
Useful tips and limitations
- Copy the complete header block, including Date and Age when estimating freshness.
- A present security header can still be ineffective or inappropriate for an application.
- Set the evaluation time to the moment the response was captured if you are reviewing an old log, so the freshness estimate matches that moment.
- When you paste a redirect chain, pick each block from the Header block menu to review every hop, not just the final response.
Common questions
Does this tool check the headers on my live website?
No. It analyzes only pasted or imported text. It never fetches a URL or verifies a deployed configuration.
Why are browser and CDN cache results different?
Shared caches can use s-maxage and must honor private response directives. Browser caches use their applicable private-cache rules.
Does no-cache mean a response cannot be stored?
No. It generally requires revalidation before reuse. no-store instructs caches not to store the response. Field-qualified directives need closer review.
Does a clean header report prove the application is secure?
No. Checks are limited to common header patterns. Transport, full CSP behavior, application logic and real browser interactions are not tested.
Can I paste headers as JSON?
Yes. Use an object of header names and values, or an array of entries with name and value. A list of values under one name, such as several Set-Cookie lines, is supported.
How large can the pasted input be?
Up to 200,000 characters, 4,000 lines, 50 blocks and 2,000 headers in total. Imported files must be smaller than 200 KB.
Why does the tool warn about folded header lines?
A line that starts with whitespace continues the previous header in an old format. The tool joins it to the previous value and suggests using one line per header.
Your input is processed in your browser without a ToolWorld Online account. Copy or download anything you want to keep before leaving the page.