HTTP Header Inspector
Paste raw request or response headers to have them grouped by category, duplicates found, and risky Set-Cookie, CORS and Server headers flagged. It runs in your browser.
Paste raw headers (from curl -i or DevTools) and get a categorized table plus security warnings. Nothing leaves your browser.
What the inspector flags, case by case
Each example below was run through this page's inspector when the site was built, and the warnings are its own words. Paste any of them into the box above to see the same result. The checks cover cookies, CORS, version disclosure, HSTS, CSP, repeated headers and deprecated headers; they read the headers you paste and cannot see how your server behaves on other requests.
A session cookie with none of its flags
A session cookie is the thing an attacker most wants, and each missing attribute opens a different door.
Headers
Set-Cookie: sid=abc123; Path=/
What the inspector reports
Set-Cookiemissing HttpOnly, so any injected script can read it. Add HttpOnly unless the cookie is deliberately JS-readable.Set-Cookiemissing Secure, so it can travel over plain HTTP. Add Secure on any HTTPS site.Set-Cookiemissing SameSite. Chrome and Edge treat that as Lax, but Firefox and Safari do not, so set it explicitly to get the same behavior everywhere.
The same cookie set properly
Secure, HttpOnly and SameSite are all present, so nothing is flagged.
Headers
Set-Cookie: sid=abc123; Path=/; Secure; HttpOnly; SameSite=Lax
What the inspector reports: nothing
Wildcard CORS with credentials
A common copy-paste mistake when an API starts needing cookies.
Headers
Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: true
What the inspector reports
Access-Control-Allow-OriginAccess-Control-Allow-Origin: * with Allow-Credentials: true is invalid. Browsers refuse to let the page read a credentialed response from a wildcard origin. Echo the specific Origin instead.
Wildcard CORS on its own
Legitimate for public data, so this is a reminder rather than an error.
Headers
Access-Control-Allow-Origin: *
What the inspector reports
Access-Control-Allow-OriginWildcard CORS exposes the response to any origin. Fine for public data, wrong for anything user-specific.
Version and stack disclosure
Neither is a vulnerability by itself; both shorten an attacker's search.
Headers
Server: nginx/1.18.0 X-Powered-By: Express
What the inspector reports
Serveradvertises an exact version (nginx/1.18.0), which makes known-CVE matching trivial. Suppress or generalise it.X-Powered-Bystack disclosure. Remove this header; it tells an attacker exactly what to probe.
A short HSTS lifetime
One day of HSTS protects only visitors who come back within a day.
Headers
Strict-Transport-Security: max-age=86400
What the inspector reports
Strict-Transport-Securitymax-age=86400 is under 180 days, so the protection lapses quickly for visitors who return less often. Security scanners commonly expect 180 days, and the HSTS preload list requires one year (31536000).
A header sent twice
Often the result of two layers (an app and a proxy) each adding their own value.
Headers
Cache-Control: no-store Cache-Control: max-age=60
What the inspector reports
Cache-Controlsent 2 times. A recipient may join repeated lines into one comma-separated value (no-store, max-age=60), so send one header with the combination you mean.
A CSP that never restricts scripts
A policy can look strict and still leave scripts, the main thing CSP is for, unrestricted.
Headers
Content-Security-Policy: img-src 'self'
What the inspector reports
Content-Security-Policyhas no default-src or script-src, so scripts are unrestricted regardless of the rest of the policy.
A deprecated protection header
Still common in older server templates.
Headers
X-XSS-Protection: 1; mode=block
What the inspector reports
X-XSS-Protectiondeprecated and dropped by modern browsers. It can introduce XSS in older ones; rely on CSP instead.