🔍 HTTP Headers Inspector

Q: What are the most important security headers?

Key security headers include: Strict-Transport-Security (HSTS — forces HTTPS), Content-Security-Policy (prevents XSS), X-Content-Type-Options: nosniff (prevents MIME sniffing), X-Frame-Options (prevents clickjacking), and Referrer-Policy.

Q: What does Cache-Control: max-age mean?

max-age=N tells the browser to cache the response for N seconds. For example max-age=3600 caches for 1 hour. Combined with public or private, it controls whether CDNs and proxies can also cache the response.

Q: What are CORS headers?

CORS (Cross-Origin Resource Sharing) headers like Access-Control-Allow-Origin control which websites can make cross-origin requests to your server. They are required for browser-based API calls from a different domain.

Q: What is the Vary header used for?

The Vary header tells caches which request headers affect the response. Vary: Accept-Encoding means different cached versions exist for gzip vs non-gzip responses. Vary: Accept-Language creates separate caches per language.

Inspect HTTP response headers for any URL. Check status code, cache-control, security headers, and content type. Free online HTTP header checker tool — no signup.

Paste HTTP Response Headers

How to Use

Paste your headers

Copy HTTP response headers from your browser DevTools (Network tab → Response Headers) and paste them here.

Inspect the results

Click Inspect to categorize headers: Security, Caching, CORS, Content-Type, and more.

Read the descriptions

Each header row includes a description explaining what it does and why it matters for web performance and security.

Frequently Asked Questions

Where do I find HTTP headers to paste? +

In Chrome/Firefox DevTools (F12) → Network tab → click any request → Headers tab. Or use curl -v https://example.com and copy the response headers (lines after < that start with a header name).

What are the most important security headers? +

Key security headers include: Strict-Transport-Security (HSTS — forces HTTPS), Content-Security-Policy (prevents XSS), X-Content-Type-Options: nosniff (prevents MIME sniffing), X-Frame-Options (prevents clickjacking), and Referrer-Policy.

What does Cache-Control: max-age mean? +

max-age=N tells the browser to cache the response for N seconds. For example max-age=3600 caches for 1 hour. Combined with public or private, it controls whether CDNs and proxies can also cache the response.

What are CORS headers? +

CORS (Cross-Origin Resource Sharing) headers like Access-Control-Allow-Origin control which websites can make cross-origin requests to your server. They are required for browser-based API calls from a different domain.

What is the Vary header used for? +

The Vary header tells caches which request headers affect the response. Vary: Accept-Encoding means different cached versions exist for gzip vs non-gzip responses. Vary: Accept-Language creates separate caches per language.

完整指南：HTTP响应头分析工具

什么是HTTP头？

HTTP头控制缓存（Cache-Control）、安全性（CSP、HSTS）、压缩（Content-Encoding）和CORS。审查网站的响应头可发现安全问题和次优配置。

如何使用

输入要分析的URL。
查看安全和性能头的分析。
修复标记为缺失或不正确的头。

专业技巧

必要的安全头：HSTS、X-Frame-Options、Content-Security-Policy。
带哈希的静态资源使用Cache-Control: max-age=31536000, immutable。
确保所有响应都包含X-Content-Type-Options: nosniff。