Header analyzer
Header and Cache-Control Analyzer
Paste HTTP response headers and this page locally parses a header table, caching behavior, validators, Vary, and common security response headers. The tool does not fetch the target URL automatically.
Frontend onlyNo URL fetchCache and security headers
Paste response header text
Browsers are limited by CORS, so a frontend-only page cannot reliably fetch arbitrary URL response headers. Copy response headers from browser DevTools, curl -I, or another tool and paste them here.
Response header input
All analysis runs locally in this browser.
Waiting for analysis
Paste response headers and click Analyze. Results will show a parsed table, cache policy, security header state, and recommendations.
Analysis result
Cache policy analysis
Recommendations
Risk notes
Cache-Control directives
| Directive | Value | State |
|---|---|---|
| max-age | - | Missing |
| s-maxage | - | Missing |
| no-cache | - | Missing |
| no-store | - | Missing |
| public | - | Missing |
| private | - | Missing |
| must-revalidate | - | Missing |
| immutable | - | Missing |
| stale-while-revalidate | - | Missing |
| stale-if-error | - | Missing |
Common security response headers
Strict-Transport-Security
Strict-Transport-Security can force browsers to use HTTPS on future requests.
Content-Security-Policy
Content-Security-Policy can restrict script, style, image, and other resource sources.
X-Content-Type-Options
X-Content-Type-Options: nosniff reduces MIME sniffing risk.
X-Frame-Options
X-Frame-Options helps reduce clickjacking risk.
Referrer-Policy
Referrer-Policy controls which Referer details are sent on cross-site requests.
Permissions-Policy
Permissions-Policy restricts browser features and sensor APIs.
Parsed headers
| Header | Value | Count |
|---|
What it analyzes
Cache-Control
Parses max-age, s-maxage, no-cache, no-store, public, private, must-revalidate, immutable, stale-while-revalidate, and stale-if-error.
Cache validators
Checks Expires, ETag, Last-Modified, and Vary with notes about revalidation and cache key risks.
Security headers
Checks whether HSTS, CSP, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, and Permissions-Policy are present.
FAQ
Why not enter a URL and detect automatically?
Browser CORS rules usually prevent frontend-only pages from reading arbitrary site response headers, so this tool analyzes pasted text only.
How are duplicate headers handled?
Header names are grouped case-insensitively and every observed value is kept. Analysis uses the combined values and calls out duplicates.
Is content sent to a server?
No. Parsing, table rendering, recommendations, and copy output all run in the current browser.