HTTP Header Analysis
Analyze HTTP response headers from this page. See security headers, caching policies, and server configuration in real-time.
HTTP headers are metadata sent between your browser and web servers with every request. They control caching, security, authentication, and content delivery. Security headers like HSTS, CSP, and X-Frame-Options protect against common attacks.
HTTP headers are the backbone of web communication. Every time your browser requests a webpage, it sends request headers containing information about what it can accept, its preferred language, cookies, and authentication tokens. The server responds with response headers that describe the content being returned, how it should be cached, and what security policies apply.
Headers follow a simple Name: Value format and are transmitted before the actual page content. While invisible to most users, headers control critical behaviors like whether your connection is encrypted, how long content is cached, what scripts can execute on the page, and whether the page can be embedded in other websites.
Understanding HTTP headers is essential for web developers, security professionals, and system administrators. Misconfigured headers can lead to security vulnerabilities, poor performance, broken functionality, and privacy leaks. This tool analyzes the headers returned by your current page to help you understand what each header does and identify potential issues.
Security headers are your website's first line of defense against common web attacks. They instruct the browser to enforce security policies that prevent cross-site scripting (XSS), clickjacking, data injection, and protocol downgrade attacks. Here are the most critical security headers every website should implement:
Strict-Transport-Security (HSTS) forces browsers to use HTTPS exclusively. Once set with max-age=31536000; includeSubDomains , the browser will never attempt an HTTP connection for the specified duration. This prevents SSL stripping attacks where an attacker intercepts the initial HTTP request before the HTTPS redirect.
Content-Security-Policy (CSP) is the most powerful security header. It defines which sources of content (scripts, styles, images, fonts, frames) the browser is allowed to load. A well-configured CSP can eliminate most XSS attacks by blocking inline scripts and restricting script sources to trusted domains.
X-Frame-Options and its modern replacement frame-ancestors (in CSP) prevent clickjacking by controlling whether your page can be embedded in an iframe. Setting DENY or SAMEORIGIN blocks malicious sites from framing your content and tricking users into clicking hidden elements.
Caching headers dramatically impact website performance by controlling how browsers and CDNs store and reuse responses. Proper cache configuration can reduce server load by 90%+ and make pages load near-instantly for returning visitors.
Cache-Control is the primary caching header with directives like max-age=3600 (cache for 1 hour), no-cache (revalidate every time), no-store (never cache — used for sensitive data), and public vs private (whether CDNs can cache the response).
ETag and Last-Modified enable conditional requests. When a browser has a cached copy, it can ask the server "has this changed?" using If-None-Match or If-Modified-Since . If the content hasn't changed, the server responds with a tiny 304 Not Modified — no body needed, saving bandwidth and time.
Developers frequently need to inspect and manipulate HTTP headers. Here are examples for common environments:
HTTP headers are metadata sent between your browser and web servers with every request and response. They control caching, security, content type, authentication, and more. Headers are invisible to users but critical for how the web works.
Security headers like Content-Security-Policy, Strict-Transport-Security, and X-Frame-Options protect against common attacks including cross-site scripting (XSS), clickjacking, MIME-type sniffing, and protocol downgrade attacks. Missing security headers leave websites vulnerable.
HSTS tells browsers to only connect to a website over HTTPS, never HTTP. This prevents man-in-the-middle attacks and SSL stripping. Once a browser sees the HSTS header, it will refuse to connect over unencrypted HTTP for the duration specified in max-age.
CSP is a powerful security header that tells the browser which sources of content are allowed to load. It can prevent XSS attacks by blocking inline scripts, restricting script sources, and controlling which domains can serve resources like images, fonts, and stylesheets.
You can check HTTP headers using browser developer tools (Network tab), command-line tools like curl -I, or online tools like this one. For programmatic access, most HTTP libraries expose response headers — for example, fetch().then(res => res.headers) in JavaScript.
The Server header discloses information about the web server software (e.g., nginx/1.24.0 or Apache/2.4.57). While not a direct vulnerability, this information helps attackers identify specific software versions with known exploits. Many security guides recommend removing or obfuscating this header.
Both control caching, but Cache-Control is more powerful and takes precedence. Cache-Control uses directives like max-age, no-cache, and no-store. Expires uses an absolute date/time. Cache-Control is the modern standard; Expires is kept for backward compatibility with HTTP/1.0 clients.