Online Tool Store
Security Headers Explainer
Paste HTTP response headers and get a plain-language explanation of each one, plus a check for commonly recommended headers that are missing. Runs entirely in your browser.
🔒 This tool runs entirely in your browser. Your files are never uploaded to a server.
Example shown — paste headers from `curl -I https://example.com` or your browser's Network tab, one per line.
How it works
- Retrieve response headers for a page with `curl -I <url>` or your browser's Network tab.
- Paste them in, one per line.
- See a plain-language explanation of each header, and which commonly recommended ones are missing.
FAQ
Why do I need to paste headers instead of entering a URL?
Browsers block a page from reading another site's response headers directly (a CORS restriction) — checking a live URL's headers needs a server-side request. Paste headers you've already retrieved with `curl -I <url>`, your browser's Network tab, or any HTTP client.
Which headers matter most?
Content-Security-Policy and Strict-Transport-Security generally have the biggest security impact — the first limits what a page can load (mitigating XSS), the second forces HTTPS. X-Frame-Options and Referrer-Policy are also widely recommended.
Is a missing header always a problem?
Not necessarily — some headers matter more for certain site types (e.g. Content-Security-Policy matters most for sites handling user input or third-party scripts). Treat the "missing" list as a prompt to review, not an automatic failure.
Is my data uploaded anywhere?
No — parsing and explaining headers happens entirely in your browser. Nothing is sent to a server, and no live request to any URL is made.
How we compare
| Feature | Online Tool Store | MDN documentation lookup | Third-party live scanners |
|---|---|---|---|
| Explains all your headers at once | ✓ | One header page at a time | ✓ |
| Works without a live, public URL | ✓ | ✓ | Requires a publicly reachable URL |
For staging environments or internal tools a public scanner can't reach, pasting headers you already have is the faster path.