Do I need every header on the missing-header checklist?

Not always. They are commonly recommended defaults, not universal requirements: the right set depends on your app, hosting model, embedding needs, browser support goals, and whether a header belongs at the CDN/proxy/app layer.

HTTP Security Header Helper

Q: What does this helper do?

It parses raw HTTP response headers you paste in, groups repeated headers case-insensitively, and explains common security-related ones like CSP, HSTS, CORS, Referrer-Policy, Permissions-Policy, X-Frame-Options, X-Content-Type-Options, and Set-Cookie attributes.

Q: Can this scan a live URL for me?

No. This page is a static browser tool, so it cannot reliably fetch arbitrary remote URLs and inspect their live headers. Browser CORS restrictions get in the way, which is why this tool only analyzes the headers you manually paste into it.

Q: What does Content-Security-Policy (CSP) do in one sentence?

CSP tells the browser which sources are allowed for scripts, styles, frames, images, and other content types so that injection bugs like XSS are harder to exploit.

Q: What does Strict-Transport-Security (HSTS) do in one sentence?

HSTS tells browsers to keep using HTTPS for a site after they have seen the header once, which helps prevent downgrade and SSL-stripping attacks.

Q: What do the CORS headers do in one sentence?

CORS headers tell browsers which origins are allowed to read cross-origin responses and whether credentials like cookies may be included.

Q: Is this exhaustive or authoritative?

No. The parser is intentionally heuristic and focused on a practical subset of common headers and risky combinations. It will not replace a full browser/server/security review, and it does not cover every HTTP header or every CSP/CORS edge case.

Paste raw HTTP response headers from your browser's Network tab or a command like curl -I. Parsing and analysis happen entirely in your browser. This tool analyzes pasted headers only — it does not and cannot fetch a remote URL and inspect live headers for you.

Pasted headers only

A static browser app cannot reliably scan arbitrary live URLs for headers because cross-origin requests are restricted by the browser. Paste the response headers you already collected elsewhere.

Heuristic analysis, not a full audit

Missing-header checks are phrased as commonly recommended, not universally required. Some apps need exceptions, and this helper is intentionally narrower than a full production security review.

Raw HTTP response headers

Nothing pasted yet — add some response headers above to see the parsed directives, risky combinations, missing recommended headers, and example baseline configs.

Illustrative baseline snippets

Baseline configuration examples

These are illustrative starting points, not universal best settings for every app.

/** @type {import('next').NextConfig} */
const nextConfig = {
  async headers() {
    return [
      {
        source: "/(.*)",
        headers: [
          {
            key: "Content-Security-Policy",
            value:
              "default-src 'self'; base-uri 'self'; object-src 'none'; frame-ancestors 'none'; upgrade-insecure-requests",
          },
          { key: "Referrer-Policy", value: "strict-origin-when-cross-origin" },
          { key: "X-Content-Type-Options", value: "nosniff" },
          { key: "X-Frame-Options", value: "DENY" },
          { key: "Permissions-Policy", value: "camera=(), geolocation=(), microphone=()" },
          {
            key: "Strict-Transport-Security",
            value: "max-age=31536000; includeSubDomains; preload",
          },
        ],
      },
    ];
  },
};

module.exports = nextConfig;

// Note: Next.js static export hosting often serves files directly from a CDN or
// static host, so these headers may need to be enforced at the platform layer
// too (for example Vercel vercel.json, Netlify headers, Nginx, Apache, or a CDN).

server {
  listen 443 ssl http2;
  server_name example.com;

  add_header Content-Security-Policy "default-src 'self'; base-uri 'self'; object-src 'none'; frame-ancestors 'none'; upgrade-insecure-requests" always;
  add_header Referrer-Policy "strict-origin-when-cross-origin" always;
  add_header X-Content-Type-Options "nosniff" always;
  add_header X-Frame-Options "DENY" always;
  add_header Permissions-Policy "camera=(), geolocation=(), microphone=()" always;
  add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;

  location / {
    try_files $uri $uri/ =404;
  }
}

# .htaccess or <VirtualHost> example
<IfModule mod_headers.c>
  Header always set Content-Security-Policy "default-src 'self'; base-uri 'self'; object-src 'none'; frame-ancestors 'none'; upgrade-insecure-requests"
  Header always set Referrer-Policy "strict-origin-when-cross-origin"
  Header always set X-Content-Type-Options "nosniff"
  Header always set X-Frame-Options "DENY"
  Header always set Permissions-Policy "camera=(), geolocation=(), microphone=()"
  Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
</IfModule>

HTTP security header examples

Review headers as a policy set: individual directives can interact or contradict each other.

Basic content restrictions

Content-Security-Policy: default-src 'self'; object-src 'none'; base-uri 'self'

A starting policy that still needs application-specific script, style, image, and connection sources.

Cookie hardening

Set-Cookie: session=example; Secure; HttpOnly; SameSite=Lax

The browser limits insecure transport, script access, and some cross-site requests.

HTTP Security Header Helper

HTTP security header examples

Common mistakes

FAQ

What does this helper do?

Can this scan a live URL for me?

What does Content-Security-Policy (CSP) do in one sentence?

What does Strict-Transport-Security (HSTS) do in one sentence?

What do the CORS headers do in one sentence?

Do I need every header on the missing-header checklist?

Is this exhaustive or authoritative?