HTTP Header Checker, Parse & Analyze Response Headers
Paste the raw HTTP response headers from curl or DevTools and get an instant, honest read: a clean parsed table, the status line and redirect chain, caching and compression notes, cookie and CORS flags, and a graded security-header report, all computed locally in your browser.
What is the http header checker?
The HTTP Header Checker parses raw response headers from curl or DevTools into a clean table, then interprets the status line, redirect chain, caching, gzip/Brotli compression, Set-Cookie flags and CORS. It also grades HSTS, CSP and other security headers 0–100. Free and browser-based, so headers from staging boxes stay private.
The GigAI HTTP Header Checker takes the raw response headers you paste, exactly as `curl -I`, `curl -sD -` or your browser's DevTools print them, and turns a wall of text into something you can actually reason about. It reads the HTTP status line and code, folds duplicate headers, and lays every field out in a sorted, copy-friendly table with the value fully visible. Then it interprets what those headers mean for real: it flags a redirect (301, 302, 307, 308) and reads the `Location` target, checks whether caching is configured sensibly through `Cache-Control`, `ETag`, `Expires` and `Age`, confirms whether responses are compressed with gzip, Brotli or Zstandard via `Content-Encoding`, surfaces the `Set-Cookie` flags that matter (`Secure`, `HttpOnly`, `SameSite`), and reports the CORS and content-type signals crawlers and browsers act on. On top of that it runs the same security-header audit trusted by security teams, HSTS, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy and Permissions-Policy, and rolls the result into a 0–100 score and A–F grade with a plain-English fix for every gap. Because it works purely on text you paste, using the browser's own parsing with no network request, it happily inspects headers from a staging box, an internal service, a login-gated page, or a competitor's response you captured, and nothing you paste ever leaves your machine.
- Difficulty:
- Easy
- Typical time:
- ~30s
- Processing:
- 100% browser processing
Last updated
How to use the http header checker
- 1
Capture the raw headers
Run `curl -sSI https://example.com` (or `curl -sD - -o /dev/null https://example.com` to include the status line), or in DevTools open Network → click the request → Headers → view the raw response headers.
- 2
Paste them in
Paste the raw block into the input, an optional leading HTTP status line is understood, blank lines are ignored, and duplicate headers are folded automatically.
- 3
Read the parsed report
See the status and any redirect, the sorted header table, the caching/compression/cookie/CORS notes and the graded security-header audit, each with a plain-English explanation.
- 4
Fix and re-check
Apply the suggested fixes on your server or CDN, capture the headers again, and paste them back to confirm the score went up and the warnings cleared.
What HTTP Header Checker includes
Clean parsed header table
Every header is parsed, duplicate fields are folded, and the result is laid out in a sorted, copy-friendly table with the full value visible. No more squinting at a wrapped terminal dump.
Status & redirect reading
The HTTP status line and code are surfaced up front, and any 301/302/307/308 redirect is flagged with its Location target so you can trace where a URL actually resolves.
Caching & compression notes
Cache-Control, ETag, Expires, Age and Vary are read for cacheability, and Content-Encoding is checked for gzip, Brotli or Zstandard so you know whether responses ship compressed.
Graded security-header audit
HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy and Permissions-Policy are each evaluated and rolled into a 0–100 score and A–F grade with a fix for every gap.
Cookie, CORS & content flags
Set-Cookie is inspected for Secure, HttpOnly and SameSite. CORS and content-type signals are surfaced so you can spot a leaky cookie or a misconfigured cross-origin response fast.
Copy, download & sample
Copy the full report as text, download it, or load a realistic sample to see the tool in action, and paste from your clipboard with one click or drop a saved headers file.
Why use our http header checker
Understand a response in seconds
Instead of scanning a raw header dump line by line, you get a table plus a prioritised read of what those headers actually do (status, caching, compression, security and cookies) at a glance.
Catch the misconfiguration before users do
A missing nosniff, a cookie without HttpOnly, an uncompressed response or an accidental noindex redirect all jump out immediately, so you fix them before they cost you rankings, speed or safety.
Works on headers you can't fetch
Because it analyzes text you paste, it handles staging boxes, internal services, VPN-only endpoints and password-gated pages that a public online checker simply can't reach.
Private by design
All parsing and grading happen locally in your browser with no network request, so confidential headers, internal hostnames and session cookies never leave your machine.
Built for the way you work
From quick one-off fixes to daily workflows, see how people put this tool to use.
- Backend / DevOps engineer
Verify a deploy's headers
After changing an nginx, Apache or CDN config, capture the live response headers and confirm caching, compression and security directives are set exactly as intended before promoting the release.
- Security engineer
Grade a site's security posture
Paste a response's headers to get an instant HSTS/CSP/X-Frame-Options audit with a letter grade and remediation notes: ideal for a quick pass during a review or pentest write-up.
- SEO / performance specialist
Debug caching, compression & redirects
Confirm pages are gzip/Brotli compressed, that Cache-Control is CDN-friendly, and that a redirect chain resolves in one hop to the canonical URL rather than bouncing through several statuses.
- Frontend developer
Diagnose a CORS or cookie issue
Inspect the Access-Control-* and Set-Cookie headers on a failing request to see whether a missing CORS header or a wrong SameSite flag is behind the browser error.
Supported formats
Accepts Raw HTTP headers, curl -I output and Text, and produces Report, Text and Table, all processed locally in your browser.
- Raw HTTP headers
- curl -I output
- Text
- Report
- Text
- Table
Frequently asked questions
Recommended tools
Security Header Checker
Paste your HTTP response headers and get an instant A–F security grade with per-header pass/warn/fail verdicts and copy-ready fixes for HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy and Permissions-Policy, 100% in your browser.
SSL Certificate Checker
Paste a PEM/X.509 certificate to extract its SHA-1 & SHA-256 fingerprints, DNS names and identity strings, then work through a complete TLS/SSL hardening checklist: 100% in your browser, nothing uploaded.
Meta Tag Analyzer
Paste a page's HTML to audit its title, description, canonical, robots, Open Graph and Twitter Card tags: with a length score, missing/duplicate checks and a live search & social preview, 100% in your browser.
Robots.txt Validator
Paste your robots.txt to parse it into User-agent groups and catch the mistakes that block Google: a stray Disallow: /, rules before any User-agent, unknown directives and a missing sitemap. 100% in your browser.
URL Parser
Paste any URL and instantly break it into protocol, host, port, path, every query parameter, hash and origin, with a live rebuilt URL to confirm the parts. 100% in your browser.
JSON Formatter
Format, validate and minify JSON in your browser with pinpoint error line + column, jump-to-error, key sorting and live editing: nothing is uploaded.
Common problems, solved
Hit a snag? Here are quick fixes for the issues people run into most.
It only shows request headers, not response headers.
Make sure you copied the *response* side. With curl, `-I` (or `-D -`) prints response headers. In DevTools use the response headers panel, not the request headers section above it. This tool analyzes what the server sent back.
My redirect target isn't showing.
A single `curl -I` shows only the first hop. Use `curl -sIL https://example.com` to follow redirects, then paste the final response's headers, or paste each hop's block to inspect the chain step by step.
Can it just fetch the headers from a URL for me?
No, and that's deliberate. Browsers block cross-origin header reads (CORS) and we run no server to proxy the request, so live-fetching isn't possible here. Capture the headers with curl or DevTools and paste them, which also lets you inspect URLs a public checker can't reach.
A duplicate header looks merged.
Per the HTTP spec, repeated headers with the same name are folded into one comma-separated value, so `Set-Cookie: a` and `Set-Cookie: b` appear as `a, b`. The individual cookie flags are still read correctly for the cookie notes.
Get the most out of it
Use `curl -sD - -o /dev/null https://example.com` to grab the status line plus every response header without downloading the body.
Add `includeSubDomains` and `preload` to your HSTS header, and aim for a max-age of at least six months, to earn the strongest grade.
Prefer a strong Content-Security-Policy over the deprecated X-XSS-Protection header: modern browsers ignore the latter.
Always ship `X-Content-Type-Options: nosniff`. It's a one-line header that shuts down a whole class of MIME-sniffing attacks.
Check that HTML responses are Brotli or gzip compressed via Content-Encoding. Uncompressed HTML is one of the most common, easily-fixed speed regressions.
What's new
Recent updates and improvements to the http header checker.
Initial release, raw response-header parsing into a table, status/redirect reading, caching, compression, cookie and CORS notes, and a graded HSTS/CSP/X-Frame-Options security audit.
Added Brotli/Zstandard detection to the compression note, Set-Cookie flag inspection (Secure/HttpOnly/SameSite), and copy/download of the full report as text.
Added a realistic sample loader, keyboard-driven clipboard paste, drag-and-drop of a saved headers file, and refined the redirect-chain wording.
Keep exploring
Related tools
Problems we solve
Definitions
From the blog
Explore categories
Common tasks
Your privacy is built in
Every header is parsed and graded locally in your browser using its native parser: nothing you paste is uploaded, stored or logged. Confidential response headers, internal hostnames, session cookies and Authorization-related values stay entirely on your device, and closing the tab erases them completely.
- Runs in your browser
- No uploads
- Nothing stored
Ready to try the http header checker?
Free, private and instant. HTTP Header Checker runs right in your browser.