HTTP Headers Viewer
Inspect server response headers, status codes, and security configurations.
Why check HTTP headers?
- Verify correct Status Codes (200, 301, 404, 500)
- Check Caching policies (Cache-Control, Expires, ETag)
- Audit Security headers (HSTS, CSP, X-Frame-Options)
- Debug Content-Type and Encoding issues
- Identify Server software type (if exposed)
Frequently Asked Questions
What are HTTP headers?
HTTP headers are key-value pairs sent between a client (browser) and a server that pass additional information about the request or response, such as caching rules, content type, and authentication.
Why is the Cache-Control header important?
Cache-Control tells browsers and CDNs how long they should store a copy of your page. Proper configuration can significantly speed up your website for returning visitors.
What is HSTS (Strict-Transport-Security)?
HSTS is a security header that forces browsers to only connect to your website via secure HTTPS, preventing downgrade attacks and cookie hijacking.
Does this tool work with redirects?
No, this specific tool fetches the headers of the exact URL you entered without following redirects (using 'manual' mode), so you can inspect if a 301/302 redirect header is present.
Why don't I see some headers?
Some headers are stripped by proxies, load balancers, or firewalls before they reach the client differently than a direct server connection.
What this tool checks
- ✓ Status Codes (200 OK, 301, 403, 404, 503)
- ✓ Server Software & Technology Stack
- ✓ Caching Policies (Cache-Control, Expires)
- ✓ Security Headers (HSTS, X-Frame-Options)
Common problems this tool finds
- ⚠️ Missing Security Headers (Risk of XSS/Clickjacking)
- ⚠️ Incorrect Caching (Slow loading speed)
- ⚠️ Unexpected 403 Forbidden errors
- ⚠️ Leaking Server Versions info
- ⚠️ Wrong Content-Type declarations
How to fix results (Quick Checklist)
- 1.Enable HSTS in your server config (Apache/Nginx) to force HTTPS.
- 2.Set explicit Cache-Control headers for static assets (images, CSS).
- 3.Hide 'Server' or 'X-Powered-By' headers to obscure tech stack info.
- 4.Add Content-Security-Policy (CSP) to prevent XSS attacks.
- 5.Ensure 'Vary' headers are set correctly for mobile/desktop serving.