HTTP Headers Checker
Paste response headers and list which common security headers are present.
Runs in your browser. Nothing is uploaded — your input is processed on this device and discarded when you close the tab.
HTTP Headers Checker
How to use this tool
- Enter your values in the fields above.
- Press Generate to see the result.
- Use Load sample to try the worked example, Copy result to copy it, or Clear to start again.
Worked example
The sample shows Strict-Transport-Security and X-Content-Type-Options present, with other common security headers missing.
What this tool does not do / Limits
This only reads headers you paste. Missing headers in pasted text do not prove a live site is insecure, and present headers are not checked for correct values in depth.
Frequently asked questions
Does it test my live site?
No. It only reads the header text you paste.
Does a missing header mean my site is unsafe?
Not on its own; it only means that header was not in the text you pasted.
Related tools
JSON Studio
Format, validate, minify, query and compare JSON in your browser, with precise line-and-column errors.
LiveRegex Tester
Test patterns against sample text with match highlighting, capture groups and a safe one-second timeout.
LiveSecurity Header and DNS Checker
Check HSTS, CSP and other security headers, TLS details, and DNS/email authentication records (SPF, DKIM, DMARC).
Live