Free tool · no signup

HTTP header analyzer

Paste the response headers from your site and get a grade and a plain list of what to fix: missing security headers, risky cookies, open CORS and software versions you are giving away.

By the Bug Circuit security team · Last updated November 11, 2026

Paste the response headers

Response headersFrom curl -I https://yourdomain.com, or the Network tab of your browser's developer tools (Response Headers). Cookie values are read here and go nowhere.These came from an https response

Paste the headers on the left to get a grade and a list of fixes.

What does this check? The headers your server sends with every page. It looks for the security headers that should be there, the settings that are wrong, the cookies that are unsafe and the version numbers that help attackers. Paste headers from curl or your browser and read the fixes.

How it works

Where to get the headers

The simplest way is a terminal: curl -I https://yourdomain.com prints the response headers. In a browser, open the developer tools, choose the Network tab, reload the page, click the first request and copy the Response Headers. Both formats work here, and so does the output of curl -v. If you paste the headers of a redirect followed by the final page, the tool uses the last response.

Check the page people actually load, not only the home page: a login page or an API response can send different headers. Everything is read in your browser, so it is safe to paste cookies, though you should still remove real session values from anything you share.

What it looks at

Transport and browser protections: Strict-Transport-Security (HSTS), Content-Security-Policy (graded with the same engine as the CSP checker), X-Content-Type-Options, clickjacking protection through X-Frame-Options or frame-ancestors, Referrer-Policy and Permissions-Policy. Cookies are checked for Secure, HttpOnly and SameSite. CORS headers are checked for wildcard-with-credentials and the null origin. Cache-Control is checked on responses that set a cookie, because a shared cache that stores a session cookie can hand it to another visitor.

It also flags headers that are obsolete or harmful: Expect-CT and Public-Key-Pins no longer do anything, Feature-Policy was replaced by Permissions-Policy, and X-XSS-Protection can introduce flaws in old browsers. Server and X-Powered-By values that carry a version number are listed because exact versions tell attackers which known bugs to try.

How the grade works

The score starts at 100 and loses points for each finding: 20 for a high one, 10 for a medium one and 3 for a low one. A is 90 or more, B is 80, C is 65, D is 50 and anything lower is F. The grade is a guide to what to fix first, and a good header set does not make an application secure. Missing headers are easy to fix, but weak passwords, vulnerable plugins and broken access control are not visible in headers at all.

Worked examples

A typical unprotected site

Apache with PHP, a session cookie and no security headers.

server: Apache/2.4.41 (Ubuntu)
x-powered-by: PHP/8.1.2
set-cookie: sessionid=9f8e7d6c5b4a; Path=/

Grade F, 2 out of 100

No HSTS, CSP or frame protection, a session cookie without Secure, HttpOnly or SameSite, and two version leaks. The score is the points left after twelve findings.

A well configured response

HSTS, a strict CSP with frame-ancestors, nosniff, a referrer policy and a permissions policy.

strict-transport-security: max-age=63072000; includeSubDomains; preload
content-security-policy: default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
permissions-policy: camera=(), microphone=()

Grade A, 100 out of 100

Every security header is present and valid, so the list of findings is all green.

A cache problem hidden in plain sight

A page that sets a login cookie and is marked cacheable.

cache-control: public, max-age=600
set-cookie: sessionid=abc; Secure; HttpOnly; SameSite=Lax

A response that sets a cookie can be cached by shared caches (medium)

A CDN may store this response together with the Set-Cookie header and give the same session to the next visitor. Use Cache-Control: private for personalised pages.

Frequently asked questions

How do I see my HTTP headers?

Run curl -I https://yourdomain.com in a terminal, or open your browser developer tools, go to the Network tab, reload, select the first request and copy its Response Headers.

Which security headers matter most?

Strict-Transport-Security to force https, Content-Security-Policy to limit what scripts can run, X-Content-Type-Options: nosniff, protection against framing, and safe cookie flags. A Referrer-Policy and a Permissions-Policy are cheap extras.

Is it safe to paste cookies here?

The headers are read in your browser and are never sent to a server. Even so, replace real session values with placeholders before you share the text with anyone else.

Why does it complain about the Server header?

Only when it contains a version number such as Apache/2.4.41. A bare name like nginx reveals little. Hiding versions makes it slightly harder to match your server to known vulnerabilities.

Do headers alone make a site secure?

No. They close several common holes in the browser, but they cannot fix a vulnerable plugin, a weak password or missing access checks. A manual test finds those.

What if my headers come from a CDN?

Test the headers your visitors receive, which are the CDN's. If a header is missing, you can usually add it in the CDN's settings or rules as well as in your own server.

Can I generate the missing headers?

Yes. The security headers generator writes the configuration for Nginx, Apache, Netlify, Vercel and Next.js.

Keep reading

Security Headers GeneratorConfig for Nginx, Apache, Netlify, Vercel and Next.js.CSP CheckerGrade a Content-Security-Policy in detail.Cookie Security CheckerCheck Secure, HttpOnly and SameSite.Security Headers CheckerFetch and grade a live site for you.

See what attackers see, for free

Run the free passive check on your website. No login, no impact on your site, results in seconds.

Ready for the full manual audit? See pricing