Paste the raw headers of an HTTP request or response, from browser DevTools or curl, and get a readable table that explains every header and decodes values like cache times and sizes. Response headers also get a security grade with specific fixes.
Last updated:
Paste output from browser DevTools, curl -I or curl -v. Parsing happens as you type.
Advertisement
Advertisement
How to use the HTTP Header Parser
Copy the headers: in DevTools open the Network tab, select a request and copy the raw response or request headers, or run curl -I https://example.com.
Paste them into the box. The table updates as you type, or click Parse headers.
Read the explanations for each header and the decoded values below them.
Check the security grade for a response and follow the advice on each card.
Export the result as CSV or JSON, or copy a text report to share.
The security headers every site should send
Header
Recommended value
Protects against
Strict-Transport-Security
max-age=31536000; includeSubDomains
HTTPS downgrade and cookie theft on public Wi-Fi
Content-Security-Policy
Site-specific, e.g. default-src 'self'; frame-ancestors 'self'
Cross-site scripting, injected third-party code
X-Frame-Options
SAMEORIGIN or DENY
Clickjacking in old browsers (CSP frame-ancestors for new ones)
X-Content-Type-Options
nosniff
MIME sniffing attacks
Referrer-Policy
strict-origin-when-cross-origin
Leaking private URLs to other sites
Permissions-Policy
camera=(), microphone=(), geolocation=()
Abuse of powerful browser features by embedded content
Cache-Control: max-age=600 lets the browser reuse the response for 10 minutes without asking the server. s-maxage sets a separate lifetime for CDNs and proxies.
no-cache does not mean "do not cache": it means the cache must check with the server (using ETag or Last-Modified) before each use. no-store is the one that forbids storing.
ETag and Last-Modified allow conditional requests; when nothing changed, the server answers 304 Not Modified with no body. See all codes in HTTP Status Codes.
Vary: Accept-Encoding tells caches to keep separate copies for compressed and uncompressed versions.
Age, X-Cache and CF-Cache-Status show whether a CDN served a cached copy (HIT) or fetched it from the origin (MISS).
Frequently asked questions
How do I see the HTTP headers of a website?
In Chrome, Edge or Firefox press F12, open the Network tab, reload the page and click the first request; the Headers panel shows request and response headers, and the raw view can be copied. From a terminal, curl -I https://example.com prints the response headers, and curl -v shows both request and response.
How is the security grade calculated?
Points are given for Strict-Transport-Security (25), Content-Security-Policy (25), clickjacking protection via X-Frame-Options or CSP frame-ancestors (15), X-Content-Type-Options (10), Referrer-Policy (10), Permissions-Policy (10) and Cross-Origin-Opener-Policy (5). Points are deducted for version leaks such as Server: nginx/1.24.0 or X-Powered-By, and for cookies missing Secure or HttpOnly. A+ needs every check to pass.
Should I still send X-XSS-Protection?
No. The XSS auditor it controlled was removed from Chrome, Edge and Safari, and in older browsers the 1; mode=block setting could itself be abused to leak information. Current guidance is to omit the header or send X-XSS-Protection: 0 and rely on a Content-Security-Policy.
What do Secure, HttpOnly and SameSite mean on a cookie?
Secure means the cookie is only sent over HTTPS. HttpOnly hides it from JavaScript, which protects session cookies from theft through cross-site scripting. SameSite (Lax, Strict or None) controls whether the cookie is sent with requests from other sites; Lax is the browser default and blocks most cross-site request forgery.
Why do some headers start with a colon?
Headers like :status, :method, :path and :authority are HTTP/2 and HTTP/3 pseudo-headers. They carry what HTTP/1.1 puts in the first line of the message, such as the status code or the request method and path. The parser recognizes them and uses them to detect the message type.
Is it safe to paste headers that contain cookies or tokens?
Yes, the parsing happens entirely in your browser and nothing is sent anywhere. Still, treat Cookie, Set-Cookie and Authorization values as passwords: remove them before sharing the output with other people.
Are all the tools on FreeToolCabin tested for quality and accuracy?
Yes! Every tool on our site undergoes automated Q/A testing in real browser environments to ensure high precision, correct output, and zero errors. If you happen to spot a bug or have a suggestion, please contact us at [email protected] and our team will review it right away.