I Help You

HTTP Header Checker

Inspect HTTP response headers for any URL. Free, and it runs entirely in your browser — nothing you enter is uploaded.

How to use the HTTP Header Checker

1. Enter any URL to inspect its HTTP response headers.

2. Click Check Headers. Results show status code and available headers.

3. Note: Due to browser CORS restrictions, some headers may not be fully visible for all URLs.

What is it?

HTTP headers carry metadata about requests and responses: content type, caching directives, security policies, cookies, redirects, and server information. Inspecting headers is essential for debugging API issues, verifying security configurations, and diagnosing caching problems.

Important headers to check: Content-Security-Policy (XSS protection), Strict-Transport-Security (HTTPS enforcement), X-Frame-Options (clickjacking protection), Cache-Control (caching behavior), and X-Content-Type-Options (MIME sniffing prevention). For full header inspection, browser DevTools or curl are more reliable.

Example

URL to inspect
https://devy.tools
↓
HTTP Response Headers (sample)
content-type: text/html; charset=utf-8
cache-control: public, max-age=3600
x-frame-options: SAMEORIGIN
content-encoding: gzip
server: nginx

Click Fetch to see live headers. Security headers like X-Frame-Options and Content-Security-Policy appear here.

Benefits

Diagnose CORS failures by inspecting cross-origin response headers

Access-Control-Allow-Origin, Allow-Methods, and Allow-Headers are visible immediately — see exactly why a CORS request is blocked.

Verify cache headers are set correctly for every endpoint

Check Cache-Control, ETag, and Expires headers to confirm your caching strategy is actually applied by the server.

Check for missing security headers before a security audit

CSP, HSTS, X-Frame-Options, X-Content-Type-Options — see which security headers are present and which are missing.

Inspect redirect chains and final destination response headers

Follow redirects hop by hop and inspect what headers the final destination server sends back.

Frequently asked questions

Why can't I see all headers?

Browsers enforce CORS (Cross-Origin Resource Sharing). Some headers are restricted from JavaScript access unless the server explicitly allows it with Access-Control-Expose-Headers. For complete headers, use curl or browser DevTools.

What are security headers?

Security headers like Content-Security-Policy, HSTS, and X-Frame-Options protect users from XSS, man-in-the-middle attacks, and clickjacking. Check securityheaders.com for a comprehensive scan.