# HTTP Header Builder Guide

Build a tidy header block from key/value lines, with common security headers ready to add.

- Tool: https://ilham.dev/tools/http-header-builder/
- Guide URL: https://ilham.dev/guides/http-header-builder/
- Tool guides index: https://ilham.dev/guides/tools/
- Broader guide: HTTP and API Debugging (https://ilham.dev/guides/http-api-debugging/)

## What it does

A small workbench for building a header block. Type one Name: value pair per line, tick any common security headers you want added, and the page validates the names, keeps the last value for a repeat and emits a clean block ready to paste into a request or a server config.

## Use the tool

Open https://ilham.dev/tools/http-header-builder/, add the input the tool asks for, run it, and check the output before using it elsewhere.

## Input and output

- Input: text.
- Output: text.
- Category: Network.

## Privacy and processing
Processing happens locally in your browser. This tool does not upload the input to ilham.dev.

## Questions

### What makes a valid header name?

A header name is an HTTP token: letters, digits and a small set of symbols, with no spaces or colons. The builder checks each name against that rule and reports any line it cannot use instead of guessing what you meant.

### What happens if I list the same header twice?

The last value wins. That matches how most tools and servers resolve a duplicated field, and it means you can put a placeholder near the top and override it further down without editing the earlier line.

### Which security headers can I add?

HSTS, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, a starter Content-Security-Policy, Permissions-Policy and a no-store Cache-Control. They are added only when you have not already set that header yourself, so your own value is never overwritten.

### Does the page send the headers anywhere?

No. It is a text builder: the input is parsed and the output is written back into the page. Nothing is transmitted, which is safe even when the block contains an Authorization value.