What makes a valid header name?

A header name is an HTTP token: letters, digits and a small set of symbols, with no spaces or colons. The builder checks each name against that rule and reports any line it cannot use instead of guessing what you meant.

What happens if I list the same header twice?

The last line wins when its name uses exactly the **same spelling and case** as an earlier line. This builder can leave `Content-Type` and `content-type` as separate lines, even though HTTP treats field names case-insensitively. Review the output before using it.

Which security headers can I add?

HSTS, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, a starter Content-Security-Policy, Permissions-Policy and a no-store Cache-Control. They are added only if the builder has not seen the same **case-sensitive name** in your input. Review any duplicate with different capitalization; the offered values are starting points, not a complete security policy.

Does the page send the headers anywhere?

No. It is a text builder: the input is parsed and the output is written back into the page. Nothing is transmitted, which is safe even when the block contains an Authorization value.

HTTP Header Builder

Headers, one per line

Type one Name: value pair per line. Names are validated, the last value wins for a repeated name, and ticked security headers are added only when you have not set them yourself. The result is a clean block you can paste into a request or a server config.

Header block

Learn

HTTP Header Builder Guide

About this tool

A small workbench for building a header block. Type one Name: value pair per line, tick any common security headers you want added, and the page validates the names, keeps the last value for a repeat and emits a clean block ready to paste into a request or a server config.

Questions

What makes a valid header name?: A header name is an HTTP token: letters, digits and a small set of symbols, with no spaces or colons. The builder checks each name against that rule and reports any line it cannot use instead of guessing what you meant.
What happens if I list the same header twice?: The last line wins when its name uses exactly the same spelling and case as an earlier line. This builder can leave Content-Type and content-type as separate lines, even though HTTP treats field names case-insensitively. Review the output before using it.
Which security headers can I add?: HSTS, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, a starter Content-Security-Policy, Permissions-Policy and a no-store Cache-Control. They are added only if the builder has not seen the same case-sensitive name in your input. Review any duplicate with different capitalization; the offered values are starting points, not a complete security policy.
Does the page send the headers anywhere?: No. It is a text builder: the input is parsed and the output is written back into the page. Nothing is transmitted, which is safe even when the block contains an Authorization value.

HTTP Header Builder