HTTP Response Header Inspector
Paste a raw HTTP response header block (one name: value per line) and see what every header means in plain English, plus a security headers checklist. Everything runs in your browser.
Header-Name: value. The first status line (for example HTTP/1.1 200 OK) is detected and ignored.Security headers checklist
A missing security header is a hint to check your server settings, not a verdict that the site is unsafe.
| # | Header | Value | What it means |
|---|
How to get a header block
- In your browser, open DevTools (F12), go to the Network tab, reload the page, click a request and copy the Response Headers section.
- In a terminal, run
curl -I https://example.comand paste the output here. - Remove or keep the
HTTP/1.1 200 OKstatus line — the tool ignores it either way.
Frequently Asked Questions (FAQ)
What does the HTTP Response Header Inspector do?
You paste a raw HTTP response header block, one name value pair per line, and the tool parses it into a table that explains each header in plain English.
Which headers are explained by the tool?
It explains at least 15 common headers such as Content Type, Cache Control, Set Cookie, Strict Transport Security, Content Security Policy and Access Control Allow Origin. Unknown headers are still listed as not in our dictionary.
What is the security headers checklist?
It checks whether the six key security headers are present or missing in your pasted set: Strict Transport Security, Content Security Policy, X Content Type Options, X Frame Options, Referrer Policy and Permissions Policy.
Are my pasted headers sent to a server?
No. Everything is parsed in your browser and your data never leaves your device.