HTTP Headers Analyzer
Analyze HTTP response headers online, audit security headers (CSP, HSTS, CORS), inspect cookies, detect information disclosure, and review caching policies.
Rating: A+ (Excellent)
No configuration issues detected matching this filter.
How to Use
1. What Are HTTP Headers & Response Headers?
HTTP headers are key-value pairs transmitted between web clients (such as browsers, API clients, and mobile apps) and web servers. While request headers transmit client capabilities, accepted media types, and authorization credentials, HTTP response headers provide essential metadata governing:
- Transport Security: Enforcing mandatory HTTPS connections (HSTS).
- Code Injection Defenses: Restricting executable scripts and resources (CSP).
- MIME Sniffing Prevention: Blocking browser content-type guessing (
X-Content-Type-Options: nosniff). - Framing & Clickjacking: Governing iframe embedding permissions (
X-Frame-Options). - Cookie Protections: Securing authentication tokens with
Secure,HttpOnly, andSameSite. - Browser & CDN Caching: Defining max-age and cache validation rules (
Cache-Control,ETag).
2. How to Analyze HTTP Response Headers Online
Follow these steps to audit your HTTP headers:
- Select Analysis Mode: Choose 1. Analyze Headers (to paste raw response headers) or 2. Analyze URL (to perform a direct browser fetch).
- Paste Response Headers: Paste raw headers including or excluding the HTTP status line (e.g.
HTTP/2 200 OK). - Review Security Health Score: Inspect your deterministic rating (0–100) and review high, medium, and low severity findings.
- Jump to Offending Lines: Click View Line on any finding to focus and highlight the exact header line in the Monaco editor.
- Copy Remediation Snippets: Use the one-click copy buttons to grab hardened header snippets for NGINX, Apache, Cloudflare, or Express.
- Export Reports: Download a sanitized Markdown report or full JSON audit payload for CI/CD documentation.
3. Essential HTTP Security Headers Explained
Restricts where scripts, images, and styles can load from, preventing Cross-Site Scripting (XSS) and data exfiltration.
Forces modern browsers to communicate exclusively over encrypted HTTPS, eliminating SSL-stripping vulnerabilities.
Prevents browsers from MIME-sniffing a response away from the declared content type (nosniff).
Protects against clickjacking iframe overlays (DENY) and prevents URL parameter leakage.
4. Content-Security-Policy (CSP) Directives & Risks
A strong Content-Security-Policy provides fine-grained boundaries for modern web apps. ToolMono audits:
- 'unsafe-inline': Flags inline script execution unless guarded by cryptographic nonces (
'nonce-...') or SHA-256 hashes. - 'unsafe-eval': Flags dynamic JavaScript code evaluation sinks.
- Wildcards (*): Flags broad origins allowing script loading from arbitrary domains.
- default-src: Verifies baseline fallback directives are present.
5. HSTS (Strict-Transport-Security) & X-Content-Type-Options
The Strict-Transport-Security header should specify a minimum duration of one year (max-age=31536000) along with includeSubDomains. For maximum security, domains can register for browser preloading.
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Content-Type-Options: nosniff
6. X-Frame-Options & Referrer-Policy Configurations
While legacy systems use X-Frame-Options: DENY, modern standards utilize CSP frame-ancestors 'none' or frame-ancestors 'self'. The obsolete ALLOW-FROM directive is flagged because modern browsers ignore it.
7. Permissions-Policy & Cross-Origin Isolation (COOP/CORP/COEP)
Cross-Origin Opener Policy (COOP) and Cross-Origin Embedder Policy (COEP) provide process-level origin isolation, preventing Spectre-class timing side-channel attacks and enabling high-resolution browser memory APIs.
8. Cross-Origin Resource Sharing (CORS) Security Audit
Combining Access-Control-Allow-Origin: * with Access-Control-Allow-Credentials: true is dangerous. Web browsers reject this header combination, but misconfigured reverse proxies that dynamically reflect incoming Origin headers can allow attackers to steal user session data across origins.
10. Cache-Control, ETag, Compression & Server-Timing
Effective caching minimizes server load and boosts performance. The tool inspects Cache-Control directives (no-store, public, immutable), validates ETag validators, and parses backend latency breakdowns from Server-Timing.
11. Server Information Disclosure (Server, X-Powered-By)
Exposing detailed software version numbers in headers (e.g. Server: nginx/1.24.0 or X-Powered-By: PHP/7.4.3) helps attackers fingerprint infrastructure and target known CVE vulnerabilities. Suppressing these banners is an industry best practice.
12. Deterministic Security Health Score (0–100)
The Security Health Score is computed deterministically from 100 points, subtracting penalties for missing controls or insecure configurations:
- Missing CSP / HSTS: -12 to -15 points
- Dangerous CORS (Wildcard + Credentials): -15 points
- Missing X-Content-Type-Options: -12 points
- Insecure Cookies (Missing Secure/HttpOnly): -5 to -12 points per cookie
- Server Version Disclosure: -3 to -5 points
13. Step-by-Step Practical Header Audit Example
Example analysis of unhardened response headers:
HTTP/2 200 OK content-type: text/html; charset=utf-8 server: nginx/1.24.0 x-powered-by: Express set-cookie: session=abc123; SameSite=Lax
Findings Detected:
FAIL: MissingContent-Security-Policy(CSP).FAIL: MissingStrict-Transport-Security(HSTS).FAIL: MissingX-Content-Type-Options: nosniff.FAIL: Insecure Cookiesession(Missing Secure flag).WARN: Server and X-Powered-By technology disclosure.
14. Real-World DevOps, API & Security Use Cases
Verify that staging and production reverse proxies inject required security headers.
Audit CORS permissions, caching headers, and cookie attributes across REST/GraphQL endpoints.
Document transport encryption and XSS boundaries for SOC 2 and ISO 27001 assessments.
15. Exporting Sanitized Markdown & JSON Reports
Export complete audit summaries as formatted Markdown for pull request reviews or structured JSON for automated CI/CD gating pipelines. Sensitive Authorization and Set-Cookie tokens are masked by default.
16. 100% Client-Side Privacy & URL Browser CORS Handling
When you paste HTTP headers into ToolMono, 100% of the parsing and security analysis executes locally in browser memory. When analyzing a live URL, your browser sends a direct request without any server proxy. If the target server restricts cross-origin header access via CORS, ToolMono transparently notifies you instead of using third-party scrapers.
17. Authoritative References & Standards
Consult official documentation and RFC specifications:
OWASP Secure Headers Project
Authoritative OWASP guidelines for HTTP response security headers.
MDN Web Docs: HTTP Headers Reference
Comprehensive documentation of HTTP request and response header standards.
RFC 9110: HTTP Semantics (IETF Standard)
Official IETF standard for HTTP architecture, semantics, and header fields.
W3C Content Security Policy Level 3 Specification
Official W3C specification for CSP directives, sources, and execution controls.
18. Frequently Asked Questions (20 FAQs)
Related Tools
Browse all toolsOnline HAR File Sanitizer & Sensitive Data Redactor
Sanitize HAR files online by redacting cookies, Authorization headers, Bearer tokens, and other sensitive data directly in your browser.
GraphQL Playground
Test GraphQL APIs online with an interactive query editor, variables, headers, schema introspection, documentation explorer, response viewer, and GraphQL error debugging.
GraphQL Response Analyzer
Analyze GraphQL API responses online. Inspect data, errors, response paths, null values, structure, and response statistics with a privacy-first browser-based analyzer.
.env Validator
Validate .env files, detect syntax errors, duplicate keys, empty values, potential secrets, compare environments, find missing variables, and review configuration drift.
JSON Schema Validator
Validate JSON data against a JSON Schema online with detailed errors, JSON paths, draft detection, and browser-based processing.
Webhook Tester
Generate a free temporary webhook URL to capture, inspect, and debug incoming HTTP payloads, headers, and JSON in real time. Replay requests instantly.
cURL to Code
Convert cURL commands and browser DevTools requests into clean, idiomatic code for JavaScript, Python, Node.js, Go, and PHP. 100% client-side with zero server uploads.