HTTP Header Analyzer
Analyze and explain HTTP headers.
Response headers
Paste the output of `curl -I https://example.com` or copy the Headers tab in devtools.
9 headers
What each one does.
Mon, 20 Aug 2026 09:00:00 GMT
When the response was generated.
text/html; charset=utf-8
Media type and charset of the body.
public, max-age=0, must-revalidate
Caching rules for browsers and CDNs.
max-age=63072000; includeSubDomains
Forces HTTPS for this host for the given max-age.
nosniff
Stops the browser guessing a different MIME type.
strict-origin-when-cross-origin
Controls how much of the URL leaks in the Referer header.
nginx/1.24.0
Server software — often worth hiding.
Express
Framework or runtime — leaks stack detail for no benefit.
session=abc123; Path=/; SameSite=Lax
Sets a cookie on the client.
Security grade
56%
HTTP 200 · 4 of 10 checks passing
Checks
Strict-Transport-Security
Present with max-age 63072000 (730 days).
Content-Security-Policy
Missing — nothing constrains where scripts may come from.
Clickjacking protection
Neither frame-ancestors nor X-Frame-Options is set.
X-Content-Type-Options
Set to nosniff.
Referrer-Policy
Set to strict-origin-when-cross-origin.
Permissions-Policy
Missing — powerful features are left at their defaults.
server disclosure
Reveals nginx/1.24.0, which tells an attacker what to target.
x-powered-by disclosure
Reveals Express, which tells an attacker what to target.
Cookie session
Missing httponly and secure.
Cache-Control
Set to public, max-age=0, must-revalidate.
Suggested headers
Drop these into your server or CDN config.