HTTP Response Header Analyzer
Paste raw HTTP response headers to audit web security posture, caching configurations, MIME sniffing rules, and identify server information leaks.
Frequently Asked Questions
How do I extract HTTP headers from my browser?
Open Developer Tools (F12) > Network tab, reload your page, click the top document request, and view the Response Headers section. Right-click and choose "Copy response headers".
What does X-Content-Type-Options: nosniff do?
It forces browsers to strictly respect the declared Content-Type header and prevents malicious users from tricking browsers into executing user-uploaded images or text files as JavaScript.
Why is HSTS preload recommended?
HSTS preload ensures browsers hardcode an HTTPS-only connection policy for your domain before the very first request is ever dispatched, completely eliminating SSL-stripping attacks.
Is any of my server metadata logged?
No. All header parsing and score evaluations execute 100% locally in your web browser tab.