🔍 HTTP Headers Inspector

Q: What are the most important security headers?

Key security headers include: Strict-Transport-Security (HSTS — forces HTTPS), Content-Security-Policy (prevents XSS), X-Content-Type-Options: nosniff (prevents MIME sniffing), X-Frame-Options (prevents clickjacking), and Referrer-Policy.

Q: What does Cache-Control: max-age mean?

max-age=N tells the browser to cache the response for N seconds. For example max-age=3600 caches for 1 hour. Combined with public or private, it controls whether CDNs and proxies can also cache the response.

Q: What are CORS headers?

CORS (Cross-Origin Resource Sharing) headers like Access-Control-Allow-Origin control which websites can make cross-origin requests to your server. They are required for browser-based API calls from a different domain.

Q: What is the Vary header used for?

The Vary header tells caches which request headers affect the response. Vary: Accept-Encoding means different cached versions exist for gzip vs non-gzip responses. Vary: Accept-Language creates separate caches per language.

Inspect HTTP response headers for any URL. Check status code, cache-control, security headers, and content type. Free online HTTP header checker tool — no signup.

Paste HTTP Response Headers

How to Use

Paste your headers

Copy HTTP response headers from your browser DevTools (Network tab → Response Headers) and paste them here.

Inspect the results

Click Inspect to categorize headers: Security, Caching, CORS, Content-Type, and more.

Read the descriptions

Each header row includes a description explaining what it does and why it matters for web performance and security.

Frequently Asked Questions

Where do I find HTTP headers to paste? +

In Chrome/Firefox DevTools (F12) → Network tab → click any request → Headers tab. Or use curl -v https://example.com and copy the response headers (lines after < that start with a header name).

What are the most important security headers? +

Key security headers include: Strict-Transport-Security (HSTS — forces HTTPS), Content-Security-Policy (prevents XSS), X-Content-Type-Options: nosniff (prevents MIME sniffing), X-Frame-Options (prevents clickjacking), and Referrer-Policy.

What does Cache-Control: max-age mean? +

max-age=N tells the browser to cache the response for N seconds. For example max-age=3600 caches for 1 hour. Combined with public or private, it controls whether CDNs and proxies can also cache the response.

What are CORS headers? +

CORS (Cross-Origin Resource Sharing) headers like Access-Control-Allow-Origin control which websites can make cross-origin requests to your server. They are required for browser-based API calls from a different domain.

What is the Vary header used for? +

The Vary header tells caches which request headers affect the response. Vary: Accept-Encoding means different cached versions exist for gzip vs non-gzip responses. Vary: Accept-Language creates separate caches per language.

Guía: Analizador de Headers HTTP

¿Qué es?

Los headers HTTP controlan caché (Cache-Control), seguridad (CSP, HSTS), compresión (Content-Encoding) y CORS. Auditar los headers de un sitio revela problemas de seguridad y configuraciones subóptimas.

Cómo usar

Ingresa la URL a analizar.
Revisa el análisis de headers de seguridad y rendimiento.
Corrige los headers marcados como faltantes o incorrectos.

Consejos

Headers esenciales: HSTS, X-Frame-Options, Content-Security-Policy.
Cache-Control: max-age=31536000, immutable para assets con hash.
Verifica X-Content-Type-Options: nosniff en todas las respuestas.