What this tool does
HTTP Security Diagnostics parses pasted response headers and emits typed CSP, CORS, cookie, cache, and browser-security findings.
← All Tools
🛡️ HTTP Security Diagnostics Workbench
Turn pasted response headers into typed findings with severity, exact evidence, and remediation. Package header-name-only findings with the HTTP Security Review Pack; header values are excluded.
Pasted headers only — no live fetch
- Analysis runs locally. This page does not contact the host or verify global deployment behavior.
- Remove cookie values, authorization headers, API keys, session IDs, signed URLs, and internal hostnames before pasting or sharing a report.
Checks: CSP · CORS · Cookies · Cache · HSTS · content sniffing · referrer and permissions policies · technology disclosure.
Why it is useful
It turns raw headers into evidence and remediation suitable for deploy reviews without pretending to be a full vulnerability scanner.
Evidence-first findings
Every finding includes a stable code, severity, exact header or line evidence, and a bounded remediation.
Local workflow boundary
Pasted headers only; there is no live fetch, credential test, port scan, or high-volume crawler.
Privacy note
Parsing and reporting run locally in your browser.
Important limitation
A clean report does not prove application security. Headers vary by route, redirect, geography, CDN state, cookies, method, and authentication.
Quick answers
Does this test a live URL?
No. Collect safe headers with browser developer tools or curl -I, redact them, then paste them here.
Is this a full security audit?
No. It checks a bounded set of response-header policies.
Common Use Cases
Audit curl response headers
Paste redacted curl -I output and review typed security evidence.
Review CSP and CORS together
Catch unsafe policy combinations before a deployment review.
Export remediation evidence
Download the bounded JSON report for a ticket or checklist.
HTTP Developer Workbench workflow
Move between curl conversion, webhook testing, status-code reference, typed HTTP security diagnostics, redirect-chain analysis, status samples, MIME lookups, and user-agent parsing while keeping network behavior explicit.