HTTP Header Explainer

What it does

Paste a block of raw HTTP response headers (from DevTools’ Network tab, or a curl -v output, or a server log) and the tool annotates each header with what it does, why it’s there, and any security-relevant context. Especially useful for security audits, debugging unexpected browser behavior (CORS, cookies, caching), and learning what each header actually controls.

The explainer covers the headers you actually encounter in production:

• Security headers: Content-Security-Policy (XSS prevention), Strict-Transport-Security (HTTPS enforcement), X-Frame-Options / frame-ancestors (clickjacking), X-Content-Type-Options: nosniff (MIME sniffing), Permissions-Policy (feature-policy successor), Referrer-Policy.
• Caching: Cache-Control, ETag, Last-Modified, Vary, Age.
• CORS: Access-Control-Allow-Origin and related (the family that confuses everyone the first time).
• Cookies: Set-Cookie with attributes (HttpOnly, Secure, SameSite, Domain, Path, Max-Age).
• Compression and content: Content-Encoding, Content-Type, Content-Length.
• Server identification: Server, X-Powered-By (often security-relevant since they leak software versions).

For each header, the explanation includes both what the header DOES and what risky configurations to watch for (e.g. an overly-permissive CSP, a Cache-Control allowing public caching of authenticated content, a Set-Cookie missing Secure flag).

How to use it

1. Capture the raw headers from your destination — DevTools → Network → click the request → Headers tab → 'Response Headers'. Or use `curl -I <URL>` for a quick capture.
2. Paste the headers into the input. The format is `Name: value\n` per line.
3. The annotated output shows each header with its purpose, common values, and security-relevant context.
4. Look for warnings — the tool flags risky configurations (missing security headers, weak CSP, public cache for sensitive content, missing cookie attributes).
5. For verification, compare against securityheaders.com (independent audit tool that scores your headers A-F).

When to use this tool

• Auditing your own site's HTTP response headers for security and caching correctness.
• Learning what HTTP headers do (the explanations are educational).
• Debugging why a browser behaves unexpectedly (CORS preflight failing, cookies not setting, cache not invalidating).
• Reviewing third-party services' security posture as part of vendor evaluation.

When not to use it

• Request headers — the explainer focuses on response headers (the server's reply). Request headers (Authorization, Accept, User-Agent) work differently and aren't fully covered.
• Request body / payload analysis — this is headers only.
• Rare or vendor-specific headers (custom X- headers from internal services) — those need vendor docs.
• Compliance auditing (PCI, HIPAA) — the tool catches common issues but isn't a substitute for compliance-grade tooling.

Common use cases

• Pre-decision sanity-check on inputs and outputs
• Educational use &mdash; demonstrating the underlying concept
• Onboarding a colleague who needs the same calculation/conversion
• Verifying a number or output before passing it on