HTTP header analysis/security confirmation tool
Deconstructs request/response headers for security, CORS, caching, cookies, and sensitive information.
HTTP header to parse
Paste the headers you copied from DevTools, curl, HTTP logs, etc.
Parse with Ctrl/Command + Enter
Result
Displays a list of headers, diagnosis reason, and recommended response in the same order and duplication as entered.
- block
- 0
- header
- 0
- serious
- 0
- warning
- 0
- Caution
- 0
Header list
Showing 0 items| position | header name | Values | Category | Purpose | Actions |
|---|
No headers match your criteria.
Diagnosis result
Showing 0 itemsThere are no diagnostic results matching your criteria.
Check the formatted header
About this tool
See syntax, sensitive values, and typical security settings before sharing HTTP headers with third parties or exposing server settings.
Features
- HTTP/1.x, HTTP/2/HTTP/3 format, pseudo header, multiple responses
- CSP, HSTS, clickjacking, MIME sniffing measures
- CORS, cache, Content-Type, cookie attributes, product information disclosure
- Sensitive value masking such as authorization, cookies, API keys, etc.
How to use
- Paste the HTTP header or open a text file.
- Specify the input format and judgment criteria URL as necessary.
- Run the analysis and review the list and diagnostic reasons by severity.
- Copy and save masked plastic surgery results or diagnostic reports.
Limitations
- Due to browser CORS and publishing restrictions, there is no ability to automatically retrieve complete response headers from arbitrary URLs.
- For headers that are not exposed to JavaScript, such as Set-Cookie, copy and analyze them from DevTools or curl.
- Diagnosis is supplementary information that only covers the input headers and does not guarantee that there are no vulnerabilities.
- It does not reproduce all proxy, CDN, web server, and application settings.
Privacy: HTTP headers, files, criteria URLs, and analysis results are processed only within the browser and are not sent or saved to the Develop Tools server.