HTTP Header Analyzer

How to Use

1. Paste raw HTTP headers into the text area. You can include the status line or method line as the first line.
2. Click Analyze. The tool detects request vs response automatically and groups headers by category.
3. Switch between Categorized, Raw, and JSON tabs to see different views.
4. Read inline hints on security headers — warnings for misconfiguration, notes for hardening opportunities.
5. Use Copy JSON to export the parsed result for further automation.

Example: Response with security headers

HTTP/1.1 200 OK
Content-Type: application/json; charset=utf-8
Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
Content-Security-Policy: default-src 'self'; script-src 'self'
X-Content-Type-Options: nosniff
Referrer-Policy: strict-origin-when-cross-origin
Cache-Control: no-store
Set-Cookie: session=abc123; HttpOnly; Secure; SameSite=Strict; Path=/

The analyzer groups Strict-Transport-Security, Content-Security-Policy, X-Content-Type-Options, and Referrer-Policy under Security. Cache-Control lands in Caching, Content-Type in Content, and Set-Cookie in Cookie. Each card includes a one-line description and any hints — for example, a Set-Cookie without HttpOnly triggers a warning.

Example: CORS preflight

OPTIONS /api/v1/orders HTTP/1.1
Host: api.example.com
Origin: https://app.example.com
Access-Control-Request-Method: POST
Access-Control-Request-Headers: Authorization, Content-Type

This is recognized as a request. The Access-Control-Request-* pair indicates a preflight; the analyzer surfaces the Origin and lists the requested method and headers. Use it alongside the response side to debug CORS handshakes end-to-end.

Categories at a glance

• Status — the first line (status line or method line).
• Security — HSTS, CSP, X-Frame-Options, COOP/COEP/CORP, Permissions-Policy, fetch metadata.
• Caching — Cache-Control, ETag, Vary, Expires, Last-Modified, conditional headers.
• Content — Content-Type, Content-Encoding, Accept-*, Content-Disposition.
• CORS — Access-Control-* and Origin.
• Auth — Authorization, WWW-Authenticate, Proxy-Authenticate.
• Cookie — Cookie and Set-Cookie.
• Transport / Range / Proxy / General / Custom — the rest, with X-* unknown headers in Custom.

Compliance hints

Hints are conservative — they highlight obvious misconfiguration, not subjective style. Examples:

• HSTS max-age below 1 year, or missing includeSubDomains / preload directives.
• CSP containing ‘unsafe-inline’ or ‘unsafe-eval’.
• Set-Cookie without HttpOnly or Secure flags.
• Access-Control-Allow-Credentials: true paired with a wildcard origin (spec-illegal).
• Cache-Control combining no-store with max-age (dead weight).

Related tools on ZeroTool

• Cookie String Parser — break Set-Cookie or Cookie strings into a name/value/flag table.
• CSP Header Generator — build a strict Content-Security-Policy from scratch.
• HAR File Analyzer — visualize the full request waterfall from DevTools.
• HTTP Status Codes — searchable reference for 1xx–5xx.