HTTP Header Parser
Parse raw HTTP response headers, inspect caching and CORS directives, and review common security headers in one place.
Paste a response status line and headers, or headers alone.
Parsed Headers
9
Including duplicate entries
Unique Header Names
9
Case-insensitive count
Security Headers
5/6
Common headers detected
Parsed Headers
Search and filter header names and values.
application/json; charset=utf-8
public, max-age=3600
max-age=31536000; includeSubDomains
nosniff
DENY
default-src 'self'
strict-origin-when-cross-origin
https://example.com
Accept-Encoding
Showing 9 of 9 header entries.
Security Header Checklist
Checks for common security-related response headers.
Strict-Transport-Security
Encourages browsers to use HTTPS.
Present
Content-Security-Policy
Restricts permitted content sources.
Present
X-Content-Type-Options
Helps prevent MIME type sniffing.
Present
X-Frame-Options
Controls whether the page can be framed.
Present
Referrer-Policy
Controls referrer information sent by the browser.
Present
Permissions-Policy
Controls access to selected browser features.
Not detected
This checklist checks whether headers are present, not whether their values are secure or appropriate. Missing headers are not automatically vulnerabilities; requirements depend on the application and deployment environment.