HTTP Header Parser

Understanding HTTP Headers

HTTP headers are metadata sent with every request and response between browsers and servers. They control caching, authentication, content negotiation, security policies, and connection management. When you load a web page, dozens of headers are exchanged behind the scenes. Request headers tell the server what the client wants (accepted formats, language preferences, cookies). Response headers tell the browser how to handle the content (content type, caching rules, security restrictions). Understanding headers is fundamental to web development, API design, and security hardening.

Headers follow a simple format: a name, a colon, and a value. Names are case-insensitive by convention. Some headers appear in both requests and responses (like Cache-Control), while others are specific to one direction. Common request headers include Accept, Authorization, User-Agent, and Cookie. Common response headers include Content-Type, Set-Cookie, Location, and the security headers analyzed by this tool.

Security Headers Explained

Security headers instruct browsers to enable protective features that defend against common web attacks. Without these headers, browsers default to permissive behavior that attackers can exploit. Implementing the right security headers is one of the most impactful and lowest-effort security improvements you can make to any website.

Content-Security-Policy (CSP)

CSP is the most powerful security header. It specifies which sources of content the browser should trust for scripts, styles, images, fonts, frames, and other resource types. A well-configured CSP prevents cross-site scripting (XSS) attacks by blocking inline scripts, eval(), and resources from untrusted domains. Start with a strict policy like default-src 'self' and add exceptions as needed. Report-only mode lets you test a policy without enforcement.

Strict-Transport-Security (HSTS)

HSTS forces browsers to use HTTPS for all connections to your domain, even if someone types http:// or follows an HTTP link. The max-age directive specifies how long the browser remembers this rule, typically set to one year (31536000 seconds). The includeSubDomains directive extends the policy to all subdomains. HSTS prevents SSL stripping attacks, where a man-in-the-middle attacker downgrades a secure connection to plain HTTP to intercept traffic.

Other Essential Security Headers

X-Frame-Options prevents clickjacking by controlling whether your page can be embedded in iframes. X-Content-Type-Options: nosniff stops browsers from guessing content types, preventing attacks that trick browsers into executing uploaded files as scripts. Referrer-Policy controls how much URL information is leaked in the Referer header when users navigate away. Permissions-Policy restricts which browser features (camera, microphone, geolocation) your page can use, reducing the impact of XSS attacks.

Caching Headers

Caching headers control how browsers and CDNs store and reuse responses. Cache-Control directives include public, private, no-cache, no-store, and max-age. ETag provides a version identifier for conditional requests. Last-Modified specifies when the resource last changed. Proper caching configuration dramatically improves performance and reduces server load, while incorrect caching can serve stale or sensitive data to the wrong users.

Frequently Asked Questions

What are HTTP headers?

Key-value metadata sent with HTTP requests and responses. They control caching, authentication, content type, security, and connection behavior.

What are security headers?

Response headers that instruct browsers to enable security features. They prevent XSS, clickjacking, MIME sniffing, and protocol downgrade attacks.

What does Content-Security-Policy do?

CSP specifies which content sources are trusted for scripts, styles, and other resources. It is the primary defense against cross-site scripting attacks.

What is HSTS?

Strict-Transport-Security forces browsers to use HTTPS for all connections. It prevents SSL stripping attacks that downgrade secure connections.

How do I check my site's headers?

Use browser DevTools (F12, Network tab), run curl -I https://example.com, or paste headers from any source into this tool for analysis.