Data & Requests · LOCAL TOOL
HTTP Header Review
Paste response headers from a trusted local capture and review several browser-facing security controls without making a request to the host.
No API call
Your input
LOCALResult
Run the tool to see a result.
Your result will appear here. Input is not saved.
WHY THIS TOOL EXISTS
A focused job, not a black box.
Findings distinguish a missing header from a configuration that needs context. HSTS applies to HTTPS hosts, while frame policy may be expressed through CSP.
How to use it
- Paste a status line and response headers.
- Read baseline findings and context notes.
- Verify proposed changes against the real application and deployment.
TRY A WORKING EXAMPLE
Start with known input.
Load this sample into the workspace, run the tool, and compare the result shown below.
Show sample input
{
"headers": "HTTP/1.1 200 OK\nContent-Type: text/html; charset=utf-8\nX-Content-Type-Options: nosniff\nReferrer-Policy: strict-origin-when-cross-origin\nAccess-Control-Allow-Origin: *\nAccess-Control-Allow-Credentials: true"
}Expected sample result from the local tool
4 review finding(s) from 5 parsed header name(s).
REVIEW · No enforced Content-Security-Policy header was found. Decide whether a policy fits this page and test it for breakage.
CONTEXT · HSTS was not found. Review it only for an HTTPS host, including subdomain implications.
CONTEXT · No frame protection was detected through X-Frame-Options or CSP frame-ancestors.
REVIEW · A browser credentialed CORS request cannot use a wildcard allowed origin; confirm the request mode and intended allow-list.This checklist cannot inspect the deployed response, TLS, cookies, redirects, application behavior, or browser policy interactions.
LIMITS AND INTERPRETATION
What the result cannot tell you.
This is a checklist, not a penetration test or security guarantee. It cannot inspect redirects, cookies, TLS, application code, or the deployed response.
Inputs are processed in this page and are not written to local storage.