HTTP Header Inspector

Enter a URL to inspect its HTTP response headers and security header configuration.

Response

Security Headers

All Response Headers

About HTTP Header Inspection

This tool fetches the HTTP response headers from any public URL through our server-side API. It highlights important security headers and flags missing ones.

  • Strict-Transport-Security: Enforces HTTPS connections
  • Content-Security-Policy: Controls allowed content sources
  • X-Content-Type-Options: Prevents MIME-type sniffing
  • X-Frame-Options: Prevents clickjacking
  • Referrer-Policy: Controls referrer information
  • Permissions-Policy: Controls browser features

Response headers are where a surprising amount of behaviour is decided, and most of it is invisible until something breaks. Caching, security policy, compression and redirects all live here, and a header that is missing is as significant as one that is wrong. The security headers in particular fail silently: nothing warns you that a policy was never sent, the protection simply is not there.

Related tools

SSL Certificate Checker DNS Lookup IP Address Lookup

Something wrong out at the edge?

A lookup answering from the wrong record, a certificate that expires on a Sunday, a header that gives away more than it should. We look after servers, DNS and the delivery layer, and we set them up so the next surprise is caught before your users find it.

Ask about your infrastructure

Frequently Asked Questions

Which security headers actually matter?
Strict-Transport-Security and Content-Security-Policy carry most of the weight. The first stops a downgrade to plain HTTP, the second limits what the page is allowed to load and is the main defence against injected scripts. X-Content-Type-Options is a one line addition with no downside.
Why is my cache header being ignored?
Because something in front of it overrode the header, or because the response also carries a directive that contradicts it. A proxy, a CDN or the framework's own defaults will all happily replace what you set, and the header you see here is the one that actually arrived.
What does a chain of redirects cost me?
A round trip each, before anything useful is sent. Two is common and forgivable, four is a configuration that grew by accident. Search engines follow them but pass less along at each hop, and a redirect to a redirect is worth collapsing.
Should I hide the server header?
It is worth removing the version number, since that is what mass scanning matches on, but do not mistake it for a defence. Anything determined will fingerprint the software from its behaviour regardless of what the header says.
Why do I see different headers than my browser does?
Because a request from here carries no cookies, no session and a different user agent, so the server may take a different path. Compare against your browser's own network panel when the difference matters.