Copy response headers from curl -I or your browser's Network panel.
Local HTTP header review
Read your HTTP security headers at a glance.
Paste response headers from curl or DevTools to check common security, CORS, and caching signals locally in your browser.
* Nothing is uploaded. HeaderLens keeps the header block in this browser tab and never displays header values in the report.
Local HTTP header review
Turn DevTools output into a short review
Check missing and weak policies, especially CSP, HSTS, nosniff, and framing protection.
Confirm the final policy in your application and deployment environment.
FAQ
What does HeaderLens send?
Does it request my URL?
No. It only analyzes the header text you paste.
Does it show cookie values?
No. Header values are used for checks but never rendered in the report.
Does a pass guarantee security?
No. It covers common header signals and cannot replace an application security review.