HTTP Headers Analyzer

Fetching a third-party URL's response headers from browser JavaScript is blocked by CORS for most sites - the browser only exposes a small set of "simple" response headers to cross-origin fetch/XHR unless the server explicitly opts in with Access-Control-Expose-Headers. A live fetch here would silently show an incomplete, misleading picture for the majority of sites. Pasting what curl -I or your browser's Network tab already retrieved gives the true, complete header set for any site, so that is what this tool works from.

No. This tool only checks whether a header is present and its value looks reasonable - it cannot verify the policy is actually enforced correctly, matches how the server really behaves under load, or would block a real attack. Treat it as a quick presence/shape check, not a penetration test or an overall safety verdict.

All values for a repeated header name are kept and joined together for display and pattern matching (e.g. checking a CSP value for unsafe-inline still works if CSP is split across two header lines). This is a simplification - real browsers apply CSP as the strictest intersection of multiple policies rather than a simple concatenation, which this tool does not attempt to model.

Each non-blank line should look like "Name: value". An optional leading status line such as "HTTP/2 200" or "HTTP/1.1 200 OK" is recognized and skipped automatically. Lines that don't match either shape are silently ignored, and if nothing in the whole paste parses as a header, the tool shows an error asking for a real headers block instead of guessing.