UFOZoo

HTTP Headers Viewer — Analyze & Audit Response Headers

Paste raw HTTP response headers to analyze cache, security, CORS, and server headers. Detect missing security headers like HSTS, CSP, and X-Frame-Options.

Features

  • ✓Paste raw HTTP response headers for instant analysis — works with curl, browser DevTools, or any HTTP client
  • ✓Automatic header categorization: General, Cache, Security, CORS, Content, Server, and Other
  • ✓Security header audit — detects missing headers like HSTS, CSP, X-Frame-Options, and more
  • ✓Severity-based security warnings (high/medium/low) to prioritize fixes
  • ✓Parse status line to display response status code and status text
  • ✓Copy individual header values or the full header list to clipboard
  • ✓Real-time analysis as you type — no button clicking needed
  • ✓All processing runs entirely in your browser — your data never leaves your device
  • ✓Live HTTP header fetch — enter any URL and the tool fetches headers directly via your browser, no terminal or DevTools needed for quick checks
  • ✓Status line parser — extracts and displays the HTTP version, status code, and reason phrase separately for quick status interpretation
  • ✓Header count and size statistics — see how many headers the server returned and an approximate total size to assess server response efficiency
  • ✓Multi-value header support — correctly parses headers that appear multiple times (like Set-Cookie, WWW-Authenticate) and displays each value separately

How to Use

  1. 1Paste raw HTTP response headers from your browser DevTools (Network tab), curl -I output, or any HTTP client.
  2. 2Headers are automatically categorized into groups: Cache, Security, CORS, Content, and Server.
  3. 3Review the Security section for warnings about missing security headers — each includes a severity level and explanation.
  4. 4Click on any header value to copy it, or use the Copy All button to copy the complete header list.
  5. 5Use curl -I https://example.com in a terminal to get headers for any public URL.
  6. 6Open browser DevTools (F12) → Network tab → reload the page → click a request to see its response headers.
  7. 7Use the live fetch feature by entering a URL directly and clicking Fetch — the tool makes a browser fetch request and displays all response headers automatically
  8. 8Check the Cache section to understand your site's caching policy — look for Cache-Control max-age values to see how aggressively content is cached by browsers and CDNs

Frequently Asked Questions

Why does this tool use paste mode instead of fetching headers directly?

∨
Browser CORS (Cross-Origin Resource Sharing) policies prevent JavaScript from making cross-origin requests and reading response headers unless the target server explicitly allows it via Access-Control-Allow-Origin headers. Since most websites don't include this header, a browser-based fetch tool cannot read response headers. The paste approach works universally with any URL.

How do I get raw HTTP headers from a URL?

∨
Open your browser's DevTools (F12), go to the Network tab, reload the page, and click on any request to see its response headers. Alternatively, use curl -I https://example.com in a terminal, or use your browser's 'Copy as cURL' feature to get the full response.

What security headers should every website have?

∨
Essential security headers include: Strict-Transport-Security (HSTS) for HTTPS enforcement, Content-Security-Policy (CSP) to prevent XSS, X-Frame-Options to prevent clickjacking, X-Content-Type-Options to prevent MIME sniffing, and Referrer-Policy for privacy control. The tool's security audit flags missing headers with severity levels.

What is HSTS and why is it important?

∨
HTTP Strict-Transport-Security (HSTS) tells browsers to always connect to your site via HTTPS, even if the user types HTTP or clicks an http:// link. This prevents SSL stripping attacks. Without HSTS, users on insecure networks (like public WiFi) could be redirected to fake HTTP versions of your site.

What do cache headers tell me?

∨
Cache headers (Cache-Control, Expires, ETag, Last-Modified) control how browsers and CDNs store and reuse responses. A high max-age means better performance but slower content updates. No-cache or no-store means the content is always fetched fresh. Understanding these helps optimize page load speed.

What is the difference between response status codes?

∨
Status codes indicate the result of an HTTP request: 2xx (success), 3xx (redirect), 4xx (client error like 404 Not Found), 5xx (server error). The tool displays the status code and text from the HEAD response, giving you a quick health check for any URL.

Can this tool detect server technology from headers?

∨
Yes. The Server header often reveals the web server software (nginx, Apache, Cloudflare, etc.), and the X-Powered-By header may reveal the backend framework (PHP, ASP.NET, Express). The tool categorizes these under the Server group for easy identification.

Is my URL data sent to any server when fetching headers?

∨
No. The fetch request is made directly from your browser to the target URL. Your data never passes through any intermediary server. This tool has no backend, no proxy, and no logging. However, note that the target website will see your IP address in its server logs, just like any normal visit.

What is Content-Security-Policy (CSP) and why does it matter?

∨
CSP is a security header that controls which resources (scripts, styles, images, fonts) a browser is allowed to load on your page. A properly configured CSP prevents cross-site scripting (XSS) attacks by blocking inline scripts and restricting script sources to trusted domains. It can also limit form submission targets and frame embedding. Missing CSP is flagged as a high-severity warning by the tool because XSS remains one of the most common web vulnerabilities.

What can I learn from the CORS headers section?

∨
CORS (Cross-Origin Resource Sharing) headers determine whether web pages from other domains can access your API or resources. Key headers include: Access-Control-Allow-Origin (which domains are allowed), Access-Control-Allow-Methods (which HTTP methods are permitted), and Access-Control-Allow-Headers (which custom headers can be sent). The tool categorizes these under the CORS group so you can quickly verify your API's cross-origin policy. A missing or overly permissive Access-Control-Allow-Origin: * on sensitive APIs can expose data to unauthorized third-party websites.

Related Tools

Meta Tag Generator — Free Create SEO Title & Description

Create title tags, meta descriptions, Open Graph tags, Twitter Cards, and canonical URLs. Preview Google search results and social media appearance.

JSON Formatter — Beautify, Validate & Minify JSON Online

Format, minify, pretty-print, and syntax-highlight JSON data. Features key sorting, custom indentation, tree view, error highlighting, and file upload.