Security Headers Checker
Security Headers Checker inventories pasted header names and values locally. Review presence and duplicates; it does not grade security or fetch a URL.
Security Headers Checker inventories pasted header names and values locally. Review presence and duplicates; it does not grade security or fetch a URL.
Security Headers Checker is a free HTTP & Header Tools utility that runs entirely in your browser — nothing you enter is uploaded.
How to use Security Headers Checker
- Paste one response block as Name: value lines, optionally preceded by its HTTP status line.
- Read the selected header names and every reported value. Empty and duplicate values are retained.
- Review policy meaning against the response context; presence alone is not a security verdict.
- Use Copy to retain the inventory, or Clear before inspecting another response block.
About this tool
Inventories one pasted HTTP response header block. Reports presence, duplicate values and empty values for six selected policy-related names and four technology-related names, plus other supplied names. It does not fetch a URL, validate policy values, assign a security grade or exhaustively detect disclosure.
Header names are matched without regard to case. Multiple values are shown separately, without combining them or deciding which policy takes effect. Whitespace before a field name, folded continuation lines and HTTP/2 or HTTP/3 pseudo-header syntax are unsupported. Paste one response rather than a redirect chain. The tool never changes server configuration.
Frequently asked questions
What does Security Headers Checker inspect?
Inventories one pasted HTTP response header block. Reports presence, duplicate values and empty values for six selected policy-related names and four technology-related names, plus other supplied names. It does not fetch a URL, validate policy values, assign a security grade or exhaustively detect disclosure.
Does a present header mean the response is secure?
No. A name can be present with an empty, invalid or unsuitable value. Correct policy depends on the response, application and browser behavior, which this inventory does not evaluate.
Does an absent header always need to be added?
No. This is a fixed list of names, not a mandatory checklist for every response. Review the relevant context and policy requirements before changing configuration.
Does it scan a website or every disclosure header?
No. It reads only the pasted block. The four technology-related names are a limited list; other headers, response bodies or application behavior can reveal information.
How are duplicate header values handled?
Every matching line is shown separately. The tool does not merge repeated values or determine their combined browser effect.