HTTP Security Header Analyzer
Review a pasted response for security-relevant headers and cookie settings, with contextual explanations rather than a universal security score.
About HTTP security inspectorFeatures & how to use
Analyze pasted HTTP headers locally: CSP, HSTS, CORS, framing, referrer policy and cookie flags. Review findings without sending requests or uploads.
What it can do
- Review CSP directives, fallbacks, duplicate directives and report-only policies.
- Inspect HSTS, framing restrictions, MIME sniffing, referrer disclosure and CORS settings.
- Check separate Set-Cookie headers for Secure, HttpOnly, SameSite and cookie prefix requirements.
- Results describe the supplied response only; this is not a vulnerability scan or complete CSP validator.
How to use it
- Copy one raw HTTP response header block from DevTools, cURL or your intercepting proxy.
- Keep Set-Cookie values on separate lines and select Inspect headers.
- Read the contextual findings and parsed headers. Review any secrets before sharing a downloaded report.