HTTP Header Inspector
Inspect HTTP response headers for any URL.
Enter a URL to inspect its HTTP response headers. HTTPS is added automatically if no scheme is specified.
What Are HTTP Headers?
HTTP headers are metadata sent between a client (your browser) and a server with every HTTP request and response. Response headers contain critical information about how the server handles your request: what type of content is being returned, how long it should be cached, whether the connection should be encrypted, and what security policies are in effect. Headers are invisible to most users but are essential for debugging, performance optimization, and security auditing.
Security Headers
Modern web security relies heavily on HTTP response headers. Strict-Transport-Security (HSTS) forces browsers to use HTTPS. Content-Security-Policy (CSP) controls which resources can be loaded, preventing XSS attacks. X-Content-Type-Options prevents MIME-type sniffing. X-Frame-Options blocks clickjacking by controlling iframe embedding. This tool checks for all major security headers and highlights which ones are present or missing, making it easy to audit a site's security posture.
Caching and Performance
Headers like Cache-Control, ETag, Last-Modified, and Expires control how browsers and CDNs cache responses. Incorrect caching headers are a common cause of both performance issues (not caching enough) and stale content bugs (caching too aggressively). Inspecting these headers helps diagnose why a page isn't updating, why a CDN isn't caching, or why load times are slower than expected.
Common Use Cases
Developers use header inspection to debug CORS issues, verify CDN configuration, check compression (gzip/brotli), audit security headers before deployment, validate redirect behavior, and troubleshoot caching. DevOps teams check headers to verify load balancer behavior, confirm SSL termination, and validate that proxies are forwarding headers correctly.