HTTP Header Analyzer
Paste response headers or fetch a URL to see what they mean.
About this tool
Works two ways: paste a block of headers you've already copied out of your browser's dev tools (Network tab), or point it at a URL and it will fetch that page directly using the same browser fetch() mechanism any webpage uses — which means the same CORS (Cross-Origin Resource Sharing) rules apply, and fetching some third-party sites you don't control may be blocked. Even when a cross-site fetch works, the browser only reveals a few basic headers, so the security-header check is skipped for other sites rather than wrongly reporting headers as missing — paste the headers from dev tools for a full check.
Either way, each header is looked up against a built-in dictionary of common HTTP headers with a plain-English explanation, and the tool flags whether a handful of commonly-recommended security headers are present at all. This is a quick sanity check, not a full security audit — it only checks presence, not whether the values themselves are configured well.