Paste a set of HTTP headers to get a breakdown of what each one does, plus flags for missing security-relevant headers.
Tells the client what media type the body is (e.g. application/json).
Controls how the response can be cached by browsers and proxies.
Identifies the server software — consider removing/obscuring in production.
Reveals backend framework — usually best removed to reduce fingerprinting.
Sets a cookie on the client. Check Secure/HttpOnly/SameSite attributes.
CORS — which origins may read this response from a browser.
Missing strict-transport-security
Missing content-security-policy
Missing x-content-type-options
Missing x-frame-options
Missing referrer-policy
Missing permissions-policy
Cookie missing Secure: session=abc123; Path=/
Cookie missing HttpOnly: session=abc123; Path=/
Cookie missing SameSite: session=abc123; Path=/
Parsing and analysis happen entirely in your browser — headers are never sent anywhere.
Related