What makes a valid header name?

A header name is an HTTP token: letters, digits and a small set of symbols, with no spaces or colons. The builder checks each name against that rule and reports any line it cannot use instead of guessing what you meant.

What happens if I list the same header twice?

The last value wins. That matches how most tools and servers resolve a duplicated field, and it means you can put a placeholder near the top and override it further down without editing the earlier line.

Which security headers can I add?

HSTS, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, a starter Content-Security-Policy, Permissions-Policy and a no-store Cache-Control. They are added only when you have not already set that header yourself, so your own value is never overwritten.

Does the page send the headers anywhere?

No. It is a text builder: the input is parsed and the output is written back into the page. Nothing is transmitted, which is safe even when the block contains an Authorization value.

HTTP Header Builder

Headers, one per line

Type one Name: value pair per line. Names are validated, the last value wins for a repeated name, and ticked security headers are added only when you have not set them yourself. The result is a clean block you can paste into a request or a server config.

Header block

About this tool

A small workbench for building a header block. Type one Name: value pair per line, tick any common security headers you want added, and the page validates the names, keeps the last value for a repeat and emits a clean block ready to paste into a request or a server config.

Questions

What makes a valid header name?: A header name is an HTTP token: letters, digits and a small set of symbols, with no spaces or colons. The builder checks each name against that rule and reports any line it cannot use instead of guessing what you meant.
What happens if I list the same header twice?: The last value wins. That matches how most tools and servers resolve a duplicated field, and it means you can put a placeholder near the top and override it further down without editing the earlier line.
Which security headers can I add?: HSTS, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, a starter Content-Security-Policy, Permissions-Policy and a no-store Cache-Control. They are added only when you have not already set that header yourself, so your own value is never overwritten.
Does the page send the headers anywhere?: No. It is a text builder: the input is parsed and the output is written back into the page. Nothing is transmitted, which is safe even when the block contains an Authorization value.

HTTP Header Builder