win-j logo
Personal Tech Blog

Developer Network Utility

HTTP Header Analyzer

Paste HTTP response headers to check security headers, cache policy, CORS settings, content type, and cookie security options in one place.

Security Header Check Check key security headers such as HSTS, CSP, X-Frame-Options, and Referrer-Policy.
Cache Policy Analysis Review Cache-Control, ETag, and Expires settings to inspect static asset and HTML cache behavior.
CORS & Cookie Check Check Access-Control headers and Set-Cookie options such as Secure, HttpOnly, and SameSite.

HTTP Header Input

Paste response headers copied from your browser DevTools Network tab or from curl -I output.

Analysis Rule Response header names are analyzed case-insensitively.
Recommended Checks Scores are calculated by reviewing security headers, cache headers, CORS, and cookie options.
Header Analysis Score 0 pts

Enter response headers and run the analysis.

0%

Analysis Result

Check whether major HTTP headers exist and whether their recommended status is good, warning, or risky.

Ready
No analysis result yet.

Parsed Headers

Displays the entered response headers as key-value pairs.

No parsed headers yet.

Detailed Report

Copy or download the analysis result as a server configuration improvement checklist.

Enter HTTP response headers, then click Analyze HTTP Headers.

Header Check Categories

HTTP headers include items directly related to operational quality, such as security, cache, CORS, and cookie policies.

Security Headers

HSTS, CSP, X-Frame-Options, and X-Content-Type-Options help enforce HTTPS, prevent clickjacking, and reduce MIME sniffing.

Cache Headers

Cache-Control, ETag, and Expires are used to evaluate browser and CDN cache strategies.

CORS & Cookie

Access-Control-Allow-Origin and Set-Cookie options are important for checking external request permissions and session security.

Practical guide

Inspect one HTTP response at a time

Paste response headers to review security, caching, CORS and cookie indicators. If the input contains several HTTP status blocks, the analyzer evaluates only the last response.

Prepared & reviewed by
win-j
Last reviewed
2026-10-01

Who this helps

  • Developers reviewing server or proxy headers
  • Site owners comparing response settings

When to use this tool

  • Inspect a final response after redirects.
  • Review cookie attributes without sharing real session values.

From input to a checked result

  1. 1

    Copy response headers from the browser Network panel or a header-only request.

  2. 2

    Remove credentials and replace cookie values with placeholders.

  3. 3

    Paste the headers and select cookie/cache checks as appropriate.

  4. 4

    Read individual findings before interpreting the checklist score.

  5. 5

    Change the responsible server layer, capture a fresh response and compare it.

Example 1

Redirect followed by a final response

Input
HTTP/1.1 301 Moved Permanently X-Frame-Options: DENY HTTP/2 200 Content-Type: text/html
Result
Only Content-Type from the final response is analyzed.

A protective header on a redirect must not be credited to the destination.

Example 2

Cookie attributes

Input
Set-Cookie: session=example; Secure; HttpOnly; SameSite=Lax
Result
The cookie checks inspect the three attributes.

The example value is a placeholder, not an authentication token.

How it works

Lines are split at the first colon and field names are normalized to lowercase. Repeated fields, including Set-Cookie, remain separate values. A new HTTP status line resets the accumulated fields so only the last block remains.

Limitations

  • The tool never requests the target URL or follows redirects itself.
  • The score uses simple rules and does not establish that a site is secure.
  • CSP, CORS and caching require context beyond header presence.
  • Only HTTP status lines distinguish response blocks; paste separate header-only blocks separately.
Your data

Headers are parsed locally and are not sent to win-j or a target host. Remove tokens, cookies and internal identifiers before pasting.

Frequently asked questions

Is a high score a security certification?

No. Review the actual response context and use appropriate deeper tests.

Are multiple Set-Cookie lines merged?

Their individual values are retained for inspection.

Why did earlier headers disappear?

A later HTTP status line starts a new response. The report intentionally evaluates the final block only.