Skip to content

HTTP Header Inspector

HTTP Header Inspector

Inspect pasted response headers and grade security/caching/CORS posture.

Output

Run the tool to see output.

What This Tool Does

Paste raw HTTP response headers and the inspector grades the security posture (which of five key security headers are present and which are missing), then summarizes CORS and caching behavior — entirely in your browser. Grab headers with curl -sD - -o /dev/null <url> and paste the output. A response can be perfectly functional and still ship none of the security headers browsers act on.

Last updated:

This tool is provided as-is for convenience. Output should be verified before use in any production or critical context.

Programmatic Access

HTTP Header Inspector is also callable as a free HTTP JSON API at https://aidevhub.io/api/http-header-inspector/ — GET with query parameters or POST with a JSON body, no authentication, CORS enabled, 50 requests/day per IP. Responses return { ok, tool, result, meta }. 

curl -s -X POST https://aidevhub.io/api/http-header-inspector/ \
  -H "Content-Type: application/json" \
  -d '{"headers":"content-type: text/html\nstrict-transport-security: max-age=31536000\ncache-control: public, max-age=60"}'

Machine-readable contract: /api/tool/http-header-inspector.json All API endpoints: /agents/ LLM site index: /llms.txt

Agent Invocation

Best Path For Builders

Dedicated API endpoint

Deterministic outputs, machine-safe contracts, and production-ready examples.

Dedicated API

https://aidevhub.io/api/http-header-inspector/

OpenAPI: https://aidevhub.io/api/openapi.yaml

GET /api/http-header-inspector/ GET http-header-inspector
POST /api/http-header-inspector/ POST http-header-inspector

Unified Runtime API

https://aidevhub.io/api/tools/run/?toolId=http-header-inspector&a=...

GET and POST are supported at /api/tools/run/ with identical validation and limits.

Limit: 10 req / 60s, input max 512 KB.

How to Use HTTP Header Inspector

  1. 1

    Prepare your input

    Collect the source text or structured payload you want to process and paste it into the tool input fields.

  2. 2

    Select mode and run

    Choose the relevant mode (if available) and click Run to execute the deterministic transformation.

  3. 3

    Review warnings and output

    Check warnings, validation notes, and generated output before using the result in production workflows.

  4. 4

    Copy and integrate

    Copy the generated output and apply it in your project, API flow, or documentation pipeline.

Frequently Asked Questions

What is HTTP Header Inspector?
HTTP Header Inspector is a free browser-based utility on AI Dev Hub. Inspect HTTP response headers for security, caching, and CORS posture.

How do I check which security headers a website response is missing?

Fetch the headers from your terminal, then paste them here. The inspector parses each name: value line (case-insensitive), checks five security headers, and reports a score with the exact missing list — plus the CORS and cache-control posture in the same pass.

Get response headers with curl

curl -sD - -o /dev/null https://example.com

-sD - dumps the response headers to stdout and -o /dev/null discards the body, so this works even on servers that reject HEAD requests (plain curl -I can behave differently for that reason). Copy everything after the status line and paste it into the inspector.

The five security headers this inspector grades

Header What it protects against
strict-transport-security Protocol-downgrade and cookie-hijack attacks: tells browsers to use HTTPS only for future visits (HSTS).
content-security-policy Cross-site scripting and injection: restricts which sources may load scripts, styles, and other resources.
x-frame-options Clickjacking: controls whether the page may be embedded in a frame or iframe on another site.
x-content-type-options MIME-sniffing: nosniff stops browsers reinterpreting responses as a different content type.
referrer-policy URL leakage: controls how much of the current URL is sent in the Referer header on outbound navigation.

The five headers this inspector's score counts, each worth 20 points; a fuller review also covers headers like Permissions-Policy. CORS (allow-origin, allow-methods) and caching (cache-control, ETag) are reported alongside the score.

What does access-control-allow-origin: * mean?

The wildcard lets any origin read the response cross-origin — correct for public assets and open APIs, wrong for anything behind cookies or authorization headers. Per the Fetch specification, the wildcard is not accepted for credentialed requests, so an authenticated API needs an explicit origin plus access-control-allow-credentials instead.

Why check cache-control on an API response?

A missing cache-control leaves caching to heuristics, which can put per-user API responses into shared caches. For private data, no-store is the safe answer; for public content, an explicit max-age with an etag gives caches something correct to work with. The inspector shows both fields so silent-default cases are visible.

Do pasted headers leave the browser?

No. Parsing and grading run entirely client-side; nothing is fetched or transmitted by this page. Response headers can contain session cookies, internal hostnames, and infrastructure fingerprints, so strip set-cookie lines before sharing output anywhere — pasting them here stays on your machine either way.