Enter a URL above and click Check Headers
Inspects response headers, status codes, and security settings// inspect http response headers in one click
Instantly check HTTP response headers for any URL. Inspect security headers, cache-control, content-type, redirects and more. Free, browser-based, no sign-up.
Enter a URL above and click Check Headers
Inspects response headers, status codes, and security settingsType or paste any HTTP/HTTPS URL into the input field above.
Hit the button or press Enter to fetch the response headers.
Review the status code, security headers analysis, and all response headers.
The HTTP Header Checker fetches the response headers returned by any web server and displays them in a readable, searchable format. It also analyzes critical security headers and scores your site's header configuration — helping developers and sysadmins identify missing protections at a glance.
HTTP response headers are metadata sent by a web server along with every page response. They communicate instructions to the browser about caching, content type, security policies, cookies, encoding, and much more. Analyzing them is essential for debugging and security auditing.
Security headers like Strict-Transport-Security, Content-Security-Policy, and X-Frame-Options protect users from common attacks including XSS, clickjacking, and protocol downgrade attacks. Many data breaches result from missing or misconfigured security headers.
Yes. The checker follows redirect chains (up to 10 hops) and displays the final destination URL alongside the response time. The headers shown are from the final destination after all redirects have been resolved.
No. This tool runs on our server and can only reach publicly accessible URLs. To check headers on localhost or internal networks, you can use browser DevTools (Network tab) or a local tool like curl.
The security score counts how many of the key recommended security headers are present on the server response. A score of 7/7 means all recommended headers are set. Missing headers are highlighted in red to help you prioritize what to fix first.
HTTP Strict Transport Security (HSTS) tells browsers to always use HTTPS when connecting to your site, even if a user types http://. Without it, users can be subjected to SSL-stripping attacks. It's one of the most important security headers to add.
Response time is the total elapsed time from initiating the connection to receiving the complete response headers, including any DNS lookup, TCP handshake, TLS negotiation, and server processing time. It reflects real-world latency from our checking server.
Yes. We only fetch the URL you provide and return the headers. We do not log, store, or share the URLs you check. No account or sign-up is required. All processing happens server-side in real time with no persistent data storage.
An HTTP header checker is a tool that makes a real request to a web server and displays the full set of HTTP response headers returned by that server. When your browser loads any webpage, the server sends back two things: the actual HTML content and a set of headers — invisible metadata that controls how the browser handles the response. This tool makes that invisible layer visible.
HTTP headers govern a wide range of behavior: whether content is cached and for how long, what character encoding to use, whether the connection can be reused, what content type the response contains, and critically, what security policies the browser should apply. Understanding and optimizing these headers is fundamental to building fast, secure, and reliable web applications.
There are many practical reasons to inspect HTTP response headers:
Content-Security-Policy, Strict-Transport-Security, and X-Frame-Options protect users from serious attacks but are often overlooked during deployment.Cache-Control, Expires, ETag, and Last-Modified control how aggressively browsers and CDNs cache your resources. Misconfigured caching can result in stale content being served or unnecessary server load.Content-Type and Content-Encoding headers tell the browser how to interpret and decompress response data. Incorrect values here can break rendering or cause security warnings.Access-Control-Allow-Origin and related headers is the first debugging step.Our tool analyzes seven of the most important security headers. Here's what each one does:
HSTS instructs browsers to only connect to your site over HTTPS, preventing protocol downgrade attacks. The max-age directive (in seconds) tells the browser how long to remember this instruction. Adding includeSubDomains extends it to all subdomains. Example: Strict-Transport-Security: max-age=31536000; includeSubDomains
CSP is one of the most powerful security headers. It allows you to define a whitelist of trusted sources for scripts, styles, images, fonts, and other resources. By restricting where content can be loaded from, CSP dramatically reduces the risk and impact of Cross-Site Scripting (XSS) attacks. A well-configured CSP is complex but extremely valuable for high-security applications.
This header controls whether your page can be embedded in an <iframe>. Setting it to DENY or SAMEORIGIN prevents clickjacking attacks where attackers overlay transparent iframes over legitimate pages to steal clicks or credentials. Note: this header is being superseded by the frame-ancestors CSP directive.
Setting this header to nosniff prevents browsers from MIME-type sniffing — guessing the content type of a response based on its contents rather than the declared Content-Type header. MIME sniffing can be exploited to execute malicious scripts disguised as innocent files.
Controls how much referrer information is included in requests originating from your page. Setting this to strict-origin-when-cross-origin or no-referrer prevents leaking sensitive URL paths to third-party services when users click external links.
Formerly known as Feature-Policy, this header gives you fine-grained control over which browser features and APIs can be used by your page and embedded iframes. You can restrict access to the camera, microphone, geolocation, and many other powerful browser capabilities to prevent misuse by third-party scripts.
The status code is the first thing to check when something isn't working. Here are the most important ones:
Caching is one of the most impactful performance optimizations available, and it's controlled entirely through headers. The Cache-Control header accepts a set of directives:
max-age=N — Cache the response for N secondsno-cache — Revalidate with the server before serving cached contentno-store — Never cache this response (for sensitive data)public — The response can be cached by any cache (CDN, proxy, browser)private — Only the browser may cache this response, not shared cachesimmutable — The content will never change; browsers can skip revalidationmust-revalidate — After expiry, revalidate before using stale contentUsing Cache-Control: public, max-age=31536000, immutable on versioned static assets (JS, CSS, images with content hashes in their filenames) is considered best practice for maximum caching efficiency.
Once you've identified missing security headers using our checker, here's how to add them in common environments:
Header set directives in your .htaccess or server config file.add_header directives in your server or location blocks.next.config.js using the headers() function.