# HTTP Header Builder

Build a tidy header block from key/value lines, with common security headers ready to add.

## URL

https://ilham.dev/tools/http-header-builder/

## What It Does

A small workbench for building a header block. Type one Name: value pair per line, tick any common security headers you want added, and the page validates the names, keeps the last value for a repeat and emits a clean block ready to paste into a request or a server config.

## Features

- Runs in the browser
- No login required

## Input

text input.

## Output

text output.

## Privacy

Processing happens locally in the browser.

No input data is uploaded to ilham.dev.

- Requires login: false
- Requires API key: false
- Stores user data: false


## Examples

- What makes a valid header name?
- What happens if I list the same header twice?
- Which security headers can I add?
- Does the page send the headers anywhere?




## Questions

### What makes a valid header name?

A header name is an HTTP token: letters, digits and a small set of symbols, with no spaces or colons. The builder checks each name against that rule and reports any line it cannot use instead of guessing what you meant.

### What happens if I list the same header twice?

The last line wins when its name uses exactly the **same spelling and case** as an earlier line. This builder can leave `Content-Type` and `content-type` as separate lines, even though HTTP treats field names case-insensitively. Review the output before using it.

### Which security headers can I add?

HSTS, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, a starter Content-Security-Policy, Permissions-Policy and a no-store Cache-Control. They are added only if the builder has not seen the same **case-sensitive name** in your input. Review any duplicate with different capitalization; the offered values are starting points, not a complete security policy.

### Does the page send the headers anywhere?

No. It is a text builder: the input is parsed and the output is written back into the page. Nothing is transmitted, which is safe even when the block contains an Authorization value.