What are HTTP headers?

HTTP headers are key-value pairs sent between a client and server as part of every HTTP request and response. They carry metadata about the connection — content type, caching rules, security policies, authentication tokens, and more. Each header follows the format Header-Name: value and is governed by standards like RFC 7230 and RFC 9110.

Properly configured headers are critical for web security, performance, and interoperability. Misconfigured headers can expose server technology, weaken security posture, cause caching issues, or break cross-origin requests. Security headers such as Strict-Transport-Security, Content-Security-Policy, and X-Content-Type-Options are especially important for protecting users against common attacks like clickjacking, MIME-type sniffing, and protocol downgrade.

Tool description

This HTTP headers validator checks raw HTTP headers for syntax errors, security issues, and best-practice violations. Paste your headers and the tool instantly validates each one against RFC standards, flags deprecated headers, detects duplicates, warns about risky configurations, and identifies missing security headers. It reports the total header count along with a detailed list of all issues found.

Features

  • Validates header names against RFC 7230 token character rules
  • Checks header-specific values for standards like Content-Type, Cache-Control, HSTS, X-Frame-Options, and CORS
  • Flags deprecated headers (Pragma, X-Powered-By, Expect-CT, Public-Key-Pins) with recommended alternatives
  • Detects missing security headers: Strict-Transport-Security, Content-Security-Policy, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, and Permissions-Policy
  • Reports duplicate headers, empty values, and invalid control characters

How it works

The validator parses each line of input as a Name: Value pair (skipping HTTP status lines). It then runs a series of checks in order: syntax validation (valid characters, proper colon placement, no control characters), duplicate detection, deprecation lookup, and header-specific value validation. Finally, it scans for missing security headers that are recommended for production deployments. Each issue is categorized as either an error (structural problem) or a warning (best-practice concern).

Use cases

  • Auditing your web server's response headers before a security review or penetration test
  • Debugging API responses by quickly spotting malformed or missing headers
  • Verifying that security headers meet production requirements after a server configuration change