How do I get the headers?
Open developer tools in your browser, go to the Network tab, select the main document request, and copy the response headers. Alternatively run curl -I https://example.com in a terminal and paste the output.
HTTP Header Analyzer
Paste response headers to see which security headers are set, which are missing and which reveal server details.
Runs in your browser — nothing is uploaded
About the HTTP Header Analyzer
Security headers tell browsers how to handle a site. Strict-Transport-Security forces HTTPS, Content-Security-Policy limits where scripts can load from, X-Frame-Options and frame-ancestors block clickjacking, and X-Content-Type-Options stops MIME sniffing. Missing headers are a common, easy-to-fix gap.
Copy the headers from your browser's developer tools or from a command such as curl -I, then paste them here. The analyser checks six widely recommended headers and flags server or framework names that give attackers useful information.
FAQ
HTTP Header Analyzer — frequently asked
Is a missing header always a vulnerability?
Not always, but it is a missed defence. Some headers only apply to certain applications, so judge each one against what your site does. Content-Security-Policy in particular needs careful design.
Why does the tool flag Server headers?
A header such as Server: nginx/1.25.3 reveals software and version, which helps attackers choose exploits. Hiding or minimising the value is a low-cost hardening step.
Does this scan my website?
No. It only reads the headers you paste. To test a live site, you need to make a request, and this tool does not send one.
Are these six headers enough?
They cover common basics, but a full review also looks at cookies (Secure, HttpOnly, SameSite), cache rules, and CORS. Treat this as a first check rather than a complete audit.
Is my header text stored?
No. The headers are parsed in your browser and nothing is saved or sent.
Related tools
Color Contrast CheckerCheck the contrast ratio between text and background colours against WCAG AA and AAA thresholds, with a live preview.Subnet CalculatorEnter an IPv4 address with its prefix to get the network, broadcast, mask, wildcard and the range of usable hosts.URL ParserBreak any link into its protocol, host, port, path, hash and each query parameter, decoded and listed one per row.