API Header Validator

Runs in browser API Testing

Paste response headers to check Content-Type, CORS, cache, security headers (HSTS, CSP, X-Content-Type-Options), rate-limit headers and deprecated values, with actionable recommendations.

Privacy: This tool runs entirely in your browser. Your input never leaves your device.

How to use API Header Validator

  1. Copy the response headers from curl -i, your proxy or the browser DevTools and paste them.
  2. Choose "JSON API response" or "HTML page" and tick the CORS box if browsers call the endpoint cross-origin.
  3. Validate and work through the table from errors to info items.
  4. Download the checks as CSV for the backlog.

API Header Validator features

  • Checks content, security, caching, CORS, rate-limit and hygiene headers against API best practices
  • Actionable recommendations with example header values
  • Score out of 100 with counts of errors, warnings, info items and passes
  • Accepts raw "Name: value" lines (status line optional) or a JSON object
  • Mode for JSON APIs vs HTML pages; optional CORS expectation

API Header Validator example

Typical Express API headers

Input:

Content-Type: application/json
Server: nginx/1.24.0
X-Powered-By: Express
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true

Output:

Score 31/100 · Errors 1 · Warnings 6
ERROR   Access-Control-Allow-Origin — Wildcard origin combined with Allow-Credentials: true is rejected by browsers.
WARNING X-Powered-By — reveals the technology stack. Remove it.
WARNING Strict-Transport-Security — missing. Add max-age=31536000; includeSubDomains.

Frequently asked questions about API Header Validator

Which rules are checked?

Content-Type presence and charset, X-Content-Type-Options, HSTS strength, CSP, clickjacking protection, Referrer-Policy, cookie flags, Server/X-Powered-By disclosure, Cache-Control/ETag/Vary consistency, CORS pitfalls (wildcard with credentials, null origin), rate-limit headers, correlation ids, deprecated headers, duplicates and malformed values.

How is the score computed?

Start at 100, minus 15 per error, 7 per warning and 2 per info item, floored at 0. It is a quick indicator, not a compliance grade.

Can I paste headers as JSON?

Yes — a JSON object of header names to values is accepted as well as raw "Name: value" lines.

Do the recommendations apply to HTML pages?

Switch the response kind to "HTML page" to get page-oriented advice (CSP becomes a warning, text/html is fine).

Technical notes

Rules follow OWASP secure-headers guidance, RFC 9111 (caching), the Fetch standard (CORS) and the IETF RateLimit header draft. Deprecated headers (X-XSS-Protection, Expires, Pragma, HPKP) are flagged as informational.