Analysis Free · no signup

HTTP Headers Analyzer

Analyze HTTP response headers, security headers, cookies, and redirects.

Updated Enis GetmezFounder & Lead Engineer

Example output

Pre-computed real result from running HTTP Headers Analyzer against https://krawly.io

Surfaces every response header a site sends — security headers, caching directives, server fingerprint, bot-protection signals, and detected CDN.

Server
nginx/1.24.0 (Ubuntu)
HSTS
max-age=31536000; includeSubDomains
X-Frame-Options
SAMEORIGIN
Content-Security-Policy
Not set
Referrer-Policy
strict-origin-when-cross-origin
Cache-Control
s-maxage=31536000

What this tells you: Run this on your own site as a security baseline — a missing HSTS or CSP header is the most common configuration gap and the easiest to fix.

↓ Run the tool below with your own input

Explore More Free Tools

Discover 160+ free tools for web scraping, SEO analysis, OSINT, and more. 30 free uses every day — no signup required.

160+ Free Tools No Signup Required JSON / CSV / Excel 30 Uses / Day

What is HTTP Headers Analyzer?

The HTTP Headers Analyzer inspects HTTP response headers from any URL, focusing on security-critical headers like Content-Security-Policy, HSTS, X-Frame-Options, and more. It helps developers and security professionals ensure proper header configuration.

Use cases

  • Security audits — verify security headers are in place
  • Performance tuning — check caching and compression headers
  • Debugging — inspect response headers for troubleshooting
  • Compliance — ensure headers meet security standards
  • Migration testing — verify headers after server changes

Key features

Complete HTTP response header listing
Security header analysis with recommendations
Cookie inspection (flags, path, domain, SameSite)
Redirect chain tracking
Multi-URL support for bulk analysis

Frequently asked questions

CSP, HSTS, X-Content-Type-Options, X-Frame-Options, X-XSS-Protection, Referrer-Policy, Permissions-Policy, and more.

Yes, the tool follows redirect chains and shows headers at each step.

They protect against XSS, clickjacking, MIME-type attacks, and other web vulnerabilities.