Paste raw HTTP response headers to get a plain-English explanation of each header and a scorecard for the main security headers.
The analyzer parses pasted header lines into names and values and explains each one it recognises, including the flags inside Set-Cookie and what the main security headers enforce. Headers are pasted by the user — the tool cannot fetch a site's headers from a browser, because browsers do not let a page read another site's response headers in this way; the headers can be copied from a browser's developer tools network panel or from a curl -I response. Headers not in the reference list are reported as site-specific rather than guessed at.
Why does the tool not just fetch the headers from a URL? A web page cannot fetch another site's response headers like this — browsers block reading them cross-origin for security. Pasting the headers copied from developer tools or curl is the reliable route, and keeps the check local.
Which security headers does the scorecard check? Strict-Transport-Security, Content-Security-Policy, X-Frame-Options (or a frame-ancestors rule inside the CSP), X-Content-Type-Options and Referrer-Policy. Missing headers are flagged, but a missing header is context, not proof a site is unsafe.
What do the Set-Cookie flags mean? Secure means the cookie travels only over HTTPS, HttpOnly keeps it out of page scripts, and SameSite limits cross-site sending. The analyzer notes which of these flags are present on each cookie header.