Inspectors

HTTP Header Analyzer

Paste HTTP headers (from a request or response) and the tool parses each one, explains its purpose, categorizes it (request, response, security, general), and flags missing security headers. It checks for CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and other important security headers, warning when they're absent.

HTTP Header Analyzer — Parse HTTP headers, explain their purpose, and flag missing security headers

What it does

  • ▸Parses HTTP headers from raw request or response text
  • ▸Categorizes each header: request, response, general, security, entity
  • ▸Explains the purpose of each header in plain English
  • ▸Flags missing security headers (CSP, HSTS, X-Frame-Options, etc.)
  • ▸Checks CORS headers (Access-Control-Allow-*)
  • ▸Identifies deprecated or problematic header configurations

Use cases

  • ▸Auditing a web application's security headers
  • ▸Debugging a CORS issue by checking Access-Control-Allow-* headers
  • ▸Understanding what an unfamiliar HTTP header does
  • ▸Checking if a server is sending proper caching and security headers

How it works

1

Paste your HTTP headers (one per line, Name: Value format) into the input

2

The tool parses each header and looks it up in its database

3

Each header is displayed with its category and description

4

Missing security headers are flagged with warnings

Frequently asked questions

1Which security headers does it check for?

Content-Security-Policy (CSP), Strict-Transport-Security (HSTS), X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, and Cross-Origin headers. If any of these are missing from a response, the tool warns you.

2Can it analyze both request and response headers?

Yes. The tool categorizes headers as request or response based on its database. If you paste a mix of request and response headers, each one is categorized correctly. Headers not in the database are marked as 'unknown'.

3Does it check CSP for common misconfigurations?

The tool flags the absence of CSP and warns about unsafe directives like unsafe-inline and unsafe-eval. For a full CSP audit, use a dedicated CSP evaluator like Google's CSP Evaluator.

Related tools

HTTP Request Analyzer — Parse raw HTTP requests or cURL commands — breakdown method, URL, headers, body, and generate code snippets

HTTP Request Analyzer

Parse raw HTTP requests or cURL commands — breakdown method, URL, headers, body, and generate code snippets

HTTP Status Codes — Look up HTTP status codes by number or search by name/description

HTTP Status Codes

Look up HTTP status codes by number or search by name/description

REST / GraphQL Client — Parse HTTP requests or cURL commands — breakdown, code snippets (fetch, httpie), GraphQL detection

REST / GraphQL Client

Parse HTTP requests or cURL commands — breakdown, code snippets (fetch, httpie), GraphQL detection

User-Agent Parser — Break a user-agent string into browser, engine, OS, device and CPU

User-Agent Parser

Break a user-agent string into browser, engine, OS, device and CPU

Use HTTP Header Analyzer offline in Devinity

All 95 tools run locally on your Mac. No internet required, no data sent to servers.

Download Devinity →