HTTPLens
Interactive Security Audit

HTTP Header Security Analyzer

Evaluate HTTP response headers against OWASP secure headers standards, uncover information leaks, and generate hardening configurations for NGINX, Express, and Cloudflare.

Zero-Log Diagnostic: Runs entirely in your browser runtime. Sensitive tokens and session cookies never leave this page.
Security Presets:

Paste HTTP response headers above and click "Audit Headers" or select a preset to evaluate your security posture.

The OWASP Secure Headers Defense Matrix

HTTP response headers serve as the first line of browser-side defense against Cross-Site Scripting (XSS), Clickjacking, Man-in-the-Middle (MITM) downgrade attacks, and cross-site data theft.

1. Strict-Transport-Security (HSTS)

Informs browsers to strictly communicate with the domain using HTTPS for the designated max-age duration.

Adding includeSubDomains and preload prevents SSL-stripping attacks on all subdomains.

2. Content-Security-Policy (CSP)

Restricts where executable scripts, stylesheets, and images can be loaded from, neutralizing reflected and stored XSS vulnerabilities.

Disallows inline scripts and prevents unauthorized iframe framing via frame-ancestors.

3. X-Content-Type-Options (MIME Sniffing)

Setting nosniff forces the browser to treat MIME types strictly as sent, preventing attacks where executable scripts are concealed in user-uploaded media files.

4. X-Frame-Options & Clickjacking

Setting DENY or SAMEORIGIN prevents the website from being transparently loaded in a foreign <iframe>, blocking clickjacking attacks.

Frequently Asked Questions

Why is leaking the Server header considered a risk?

Headers like Server: Apache/2.4.41 (Ubuntu) or X-Powered-By: PHP/7.4.3 inform attackers of exact software versions. When new zero-day CVEs are disclosed, automated threat crawlers search for these precise version signatures to launch targeted exploits.

What makes a Set-Cookie header secure?

Production session cookies must include three crucial attributes:

  • Secure: Ensures the cookie is only transmitted over encrypted TLS connections.
  • HttpOnly: Blocks client-side JavaScript from accessing the cookie via document.cookie, mitigating session theft via XSS.
  • SameSite=Lax / Strict: Prevents the cookie from being sent in cross-site requests, mitigating Cross-Site Request Forgery (CSRF).
Does HTTPLens store or log my cookies or headers?

Zero-Log Guarantee: All header parsing, regular expression evaluation, and score calculation run exclusively inside your browser's local JavaScript execution context. No network requests are made.