🔍 HTTP Headers Inspector

Q: What are the most important security headers?

Key security headers include: Strict-Transport-Security (HSTS — forces HTTPS), Content-Security-Policy (prevents XSS), X-Content-Type-Options: nosniff (prevents MIME sniffing), X-Frame-Options (prevents clickjacking), and Referrer-Policy.

Q: What does Cache-Control: max-age mean?

max-age=N tells the browser to cache the response for N seconds. For example max-age=3600 caches for 1 hour. Combined with public or private, it controls whether CDNs and proxies can also cache the response.

Q: What are CORS headers?

CORS (Cross-Origin Resource Sharing) headers like Access-Control-Allow-Origin control which websites can make cross-origin requests to your server. They are required for browser-based API calls from a different domain.

Q: What is the Vary header used for?

The Vary header tells caches which request headers affect the response. Vary: Accept-Encoding means different cached versions exist for gzip vs non-gzip responses. Vary: Accept-Language creates separate caches per language.

Inspect HTTP response headers for any URL. Check status code, cache-control, security headers, and content type. Free online HTTP header checker tool — no signup.

Paste HTTP Response Headers

How to Use

Paste your headers

Copy HTTP response headers from your browser DevTools (Network tab → Response Headers) and paste them here.

Inspect the results

Click Inspect to categorize headers: Security, Caching, CORS, Content-Type, and more.

Read the descriptions

Each header row includes a description explaining what it does and why it matters for web performance and security.

Frequently Asked Questions

Where do I find HTTP headers to paste? +

In Chrome/Firefox DevTools (F12) → Network tab → click any request → Headers tab. Or use curl -v https://example.com and copy the response headers (lines after < that start with a header name).

What are the most important security headers? +

Key security headers include: Strict-Transport-Security (HSTS — forces HTTPS), Content-Security-Policy (prevents XSS), X-Content-Type-Options: nosniff (prevents MIME sniffing), X-Frame-Options (prevents clickjacking), and Referrer-Policy.

What does Cache-Control: max-age mean? +

max-age=N tells the browser to cache the response for N seconds. For example max-age=3600 caches for 1 hour. Combined with public or private, it controls whether CDNs and proxies can also cache the response.

What are CORS headers? +

CORS (Cross-Origin Resource Sharing) headers like Access-Control-Allow-Origin control which websites can make cross-origin requests to your server. They are required for browser-based API calls from a different domain.

What is the Vary header used for? +

The Vary header tells caches which request headers affect the response. Vary: Accept-Encoding means different cached versions exist for gzip vs non-gzip responses. Vary: Accept-Language creates separate caches per language.

Complete Guide: HTTP Headers Checker

The HTTP Headers Checker fetches the response headers for any URL and presents them in a readable format with annotations. It is one of the fastest ways to audit a site's security posture, caching strategy, and CORS configuration without writing a single line of code.

Security Headers That Matter Most

Missing security headers are one of the most common findings in web application security audits. Here are the ones to check first:

Content-Security-Policy (CSP) — Restricts which sources can load scripts, styles, images, and other resources. A missing or overly permissive CSP is a primary vector for XSS attacks.
Strict-Transport-Security (HSTS) — Tells browsers to only connect over HTTPS, even if the user types http://. The max-age directive should be at least 31536000 (one year).
X-Frame-Options — Prevents clickjacking by controlling whether the page can be embedded in an <iframe>. Use DENY or SAMEORIGIN.
X-Content-Type-Options — Setting this to nosniff stops browsers from MIME-type sniffing responses, which can prevent certain XSS vectors.
Permissions-Policy — The successor to Feature-Policy. Controls access to browser APIs like camera, microphone, and geolocation on a per-origin basis.

Caching Headers

Caching headers have a direct impact on performance and bandwidth costs. Understanding them prevents stale content bugs:

Cache-Control — The primary directive. max-age=3600 caches for one hour. no-store prevents caching entirely. stale-while-revalidate serves stale content while fetching fresh in the background.
ETag — A fingerprint of the response content. The browser sends it back as If-None-Match; if it matches, the server returns 304 Not Modified and saves bandwidth.
Last-Modified — The date the resource last changed. Works like ETag but less precise. Browsers use it with If-Modified-Since conditional requests.

CORS Headers

Cross-Origin Resource Sharing headers control which external domains can make requests to your API. A misconfigured CORS setup either blocks legitimate clients or exposes your API to any origin:

Access-Control-Allow-Origin — The permitted origin. * allows all origins (dangerous for credentialed requests).
Access-Control-Allow-Methods — Which HTTP methods the browser may use in cross-origin requests.
Access-Control-Allow-Headers — Which request headers the client is allowed to set.
Access-Control-Max-Age — How long the browser should cache the preflight response, reducing OPTIONS request overhead.

How to Read the Vary Header

The Vary header tells caches that the response may differ based on certain request headers. Vary: Accept-Encoding means the cache stores separate copies for gzip and non-gzip clients. Vary: Accept-Language means content negotiation is in play. A Vary: * effectively disables caching in shared caches like CDNs.

HTTPS Redirect Chains

The checker follows redirect chains and shows each hop. A well-configured site should redirect http:// to https:// in a single 301, then serve content. If you see a 301 followed by another 301, there is a redirect loop risk and you are wasting a network round-trip on every first visit. Double-check your web server configuration and ensure HSTS is set on the final HTTPS destination.

Debugging 404 vs 301

When a URL is not behaving as expected, the status code tells the story. A 404 with an otherwise empty header set suggests the resource genuinely does not exist. A 301 with a Location header pointing to the same URL is a redirect loop. A 200 with an unexpected Content-Type often means a framework is returning its error page as HTML with the wrong status code — a common Rails and Laravel pitfall.

Related Tools

To reproduce the exact request the checker makes, copy the equivalent command into the cURL to Code converter and generate a script. If you encounter Base64-encoded header values (common in JWT bearer tokens), use the Base64 Encoder to inspect the payload.