Web Tools · D4rC Tools

Response headers

Paste the output of curl -sI https://… or copy the response headers from the browser dev tools. With redirects, the last response is analyzed.

Everything runs in your browser. No URL is fetched – nothing leaves this page.

Assessment

Header generator

Format

Strict-Transport-Security

max-age

includeSubDomains – only if every subdomain is HTTPS preload (hstspreload.org – hard to undo)

X-Content-Type-Options: nosniff

X-Frame-Options

Referrer-Policy

Permissions-Policy

Empty = not set. Use =(self) for features the site uses.

Cross-Origin-Opener-Policy

Content-Security-Policy

Build it in the CSP tab. Empty = not set.

Send as Report-Only first (logs, blocks nothing) Hide X-Powered-By and server version

Configuration

Parse a policy

Policy or header line

Directive	Sources

Generator

Start from

Separate sources with spaces. Keywords like self, none or unsafe-inline are quoted automatically.

default-src

Fallback for all fetch directives.

script-src

style-src

img-src

font-src

connect-src

fetch(), XHR, WebSocket – list every API origin.

media-src

frame-src

worker-src

manifest-src

object-src

base-uri

No fallback to default-src.

form-action

No fallback to default-src.

frame-ancestors

Who may embed this page. Replaces X-Frame-Options.

report-uri

report-to

upgrade-insecure-requests

Output

Report-Only

Content-Security-Policy

Use case

Allowed origins

Origins

One per line: scheme://host[:port], no path.

Methods

GET POST PUT PATCH DELETE HEAD

Access-Control-Allow-Headers

Access-Control-Expose-Headers

Response headers JavaScript may read besides the safelisted ones.

Allow credentials (cookies, HTTP auth)

Preflight cache (Max-Age, seconds)

Format

Configuration

CORS only relaxes the browser's same-origin policy. It is not access control – the server must still check authentication.

Extension	MIME type	Group	Actions

"compressible" marks types worth serving with gzip/Brotli. Already compressed formats (JPEG, WOFF2, ZIP …) gain nothing.

Code	Name	Meaning

"cacheable" = may be cached without explicit freshness headers (RFC 9110).

Requirements

Largest file (MB)

Files per request

Slowest client upload (Mbit/s)

Processing

Largest image (megapixels)

Decoding needs about 4–5 bytes per pixel.

php.ini values

Calculated from the requirements – edit them to check existing values.

upload_max_filesize

post_max_size

memory_limit

max_execution_time

max_input_time

max_file_uploads

Format

Configuration

Matching web server limits

Every layer must allow the request: nginx client_max_body_size or Apache LimitRequestBody ≥ post_max_size, and proxy/FastCGI timeouts ≥ max_input_time + max_execution_time.

Header generator

Parse a policy

Generator

Generator

Check & test

Requirements

php.ini values