Grade security headers, explain every header, and simulate CORS preflight.
Tip: use samples, upload, copy, download, and send-to actions inside the workspace where available.
HTTP Header Analyzer is a free, browser-based tool that helps you understand a dataset at a glance. Grade security headers, explain every header, and simulate CORS preflight. It's built for speed and privacy: Everything runs locally in your browser — your data is never uploaded to a server. No sign-up, no installs, and no daily limits.
Profile the data first so missing values, types, duplicates, and outliers are visible before you edit it.
Review the preview, copy or download the result, and keep everything local in your browser.
API Response Inspector: Inspect a response's shape, status, caching and rate-limit signals.
Open toolAPI Request Builder: Build an HTTP request visually, then export it as curl, fetch, axios, Python or Go.
Open toolNothing leaves your browser — this parses text you paste and never makes a request. Copy headers from your browser’s Network panel, or from curl -I.
The grade is a floor, not a ceiling. Six headers are scored because they are the ones that reduce damage from a vulnerability you have not found yet. An A means nothing obvious is missing; it says nothing about your application logic.
Wildcard CORS plus credentials never works. Browsers reject Access-Control-Allow-Origin: * outright when the request carries credentials. Echo the specific origin back instead — and then you must also send Vary: Origin, or a shared cache will serve one origin’s response to another.
CORS is not access control. It only governs what browser JavaScript may read. The request still reaches your server and still runs, so a blocked response is not a blocked side effect. Anything that must be forbidden has to be forbidden server-side.
Server banners are free information for an attacker. Server and X-Powered-By hand over exact software versions to match against a CVE list. Removing them is not security, but it costs nothing.
