Question 1

What does the HTTP Header Analyzer check?

Accepted Answer

It analyzes security headers (HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, COOP, COEP, CORP), cache headers (Cache-Control, ETag, Expires, Last-Modified), cookies (Secure, HttpOnly, SameSite flags), CORS configuration, and information leakage (Server, X-Powered-By). Each header gets a pass/warn/fail rating with recommendations.

Question 2

How is the security score calculated?

Accepted Answer

The score is weighted out of 100 points. Critical headers like Content-Security-Policy (20 points) and Strict-Transport-Security (15 points) carry more weight. Each header is scored as pass (full points), warning (40% of points), or fail (0 points). The final percentage maps to a letter grade from A+ to F.

Question 3

Is this tool free and private?

Accepted Answer

Yes, the HTTP Header Analyzer is completely free, requires no signup, and runs 100% in your browser. Your headers are never sent to any server. All analysis happens client-side using JavaScript.

Question 4

How do I get my HTTP response headers?

Accepted Answer

Open your browser DevTools (F12), go to the Network tab, reload the page, click on the main document request, and look at the Response Headers section. You can also use curl -I https://example.com in a terminal to fetch just the headers.

Free HTTP Header Analyzer

Need something more powerful?

NexTool on GitHub