Free HTTP Header Inspector

Header Inspector

Analyze HTTP response headers and security posture.

HTTP headers are metadata exchanged between browsers and servers on every request. They control security, caching, content handling, and SEO — all invisible to visitors but critical to how a website functions.

Key security headers include Content-Security-Policy (prevents XSS attacks), Strict-Transport-Security (forces HTTPS), X-Frame-Options (blocks clickjacking), and X-Content-Type-Options (stops MIME sniffing). Missing any of these can leave a site vulnerable.

Performance headers like Cache-Control and ETag determine how long browsers cache resources, directly affecting load times. This tool fetches all response headers for any URL and scores the security configuration.

example.comgithub.com

Want the full picture?

Run a free Website Health Check →

Common questions

What HTTP headers should I check?

Start with Content-Security-Policy, Strict-Transport-Security, X-Frame-Options, X-Content-Type-Options, and Referrer-Policy. These protect against XSS, clickjacking, and protocol downgrade attacks.

What is the difference between this and Security Headers Analyzer?

Header Inspector shows all response headers and a security score. The Security Headers Analyzer focuses on grading security header configuration with detailed recommendations.

Do you store the URLs I inspect?

No. Requests run in real time and results are not saved on our servers.

What the Header Inspector shows

Every HTTP response includes metadata headers that control caching, security, cookies, redirects, and content type. The Header Inspector performs a live request to your URL and lists every response header in a readable table — useful when debugging CDN behavior, API responses, redirect chains, and cookie attributes without opening browser DevTools.

When to inspect headers

Debugging why a page is not caching (or caching too aggressively)
Verifying redirect chains return 301 vs 302 as expected
Checking Set-Cookie flags: Secure, HttpOnly, SameSite
Confirming a CDN adds CF-Cache-Status, X-Cache, or custom headers
Comparing response headers across environments

How to interpret key headers

Status code — 200 OK, 301/302 redirects, 404 not found, 5xx server errors. Content-Type — should match actual content; mismatches trigger MIME sniffing risks. Cache-Control — max-age, no-store, and public/private control browser and CDN caching. Location — present on redirects; verify apex-to-www and HTTP-to-HTTPS chains. Server / X-Powered-By — information disclosure; consider removing in production.

Common issues discovered

Redirect loops between www and non-www versions
Missing Cache-Control on static assets causing slow repeat visits
Session cookies without Secure flag on HTTPS sites
API returning text/html error pages instead of JSON
Compression headers absent — large responses over slow connections

Example scenario

A marketing team reported "the site feels slow." Header inspection showed HTML pages had Cache-Control: no-cache applied globally by a misconfigured nginx rule, while static assets were fine. Scoping the no-cache directive to dynamic routes only cut TTFB perception dramatically.

Limitations

We request a single URL once from our server. Geo-distributed CDNs may return different headers by region. We follow redirects up to a limited depth. For security grading, use Security Headers Analyzer.

Related resources

Understanding HTTP Headers · Security Headers · Speed Test · Post-Migration Checklist