Runs locally — nothing is uploaded
Result
Paste raw HTTP headers.
How to use
- 1Copy headers from devtools (Network → request → Headers) or from curl -I / curl -v.
- 2Paste them and choose the output.
- 3Read the security checks for responses or copy the code for requests.
One point each for HSTS, a CSP without unsafe-inline or unsafe-eval for scripts, X-Content-Type-Options, framing protection, Referrer-Policy and Permissions-Policy: 6 is A, 5 B, 4 C, 3 D, fewer F.
Yes, including pseudo-headers like :authority and :path; they are used to rebuild the URL for curl.
Pseudo-headers and Content-Length are set by the HTTP client itself; sending them by hand breaks requests.
Related tools
Subnet calculatorCIDR, netmask, host range and subnets
Cron expression parserExplain cron schedules and see the next runs
JWT decoderDecode JWT header, payload and expiry
Unix timestamp converterEpoch time to date, and date to epoch
Number base converterBinary, octal, decimal, hex and base 36
HTTP status codesSearchable list of all HTTP status codes
Infrastructure headaches?
Tell us about your stack — we reply within one business day.