HTTP Headers Checker
Inspect the raw response headers returned by any web server. Quickly audit security configurations and content policies.
Enter a URL to inspect
What Are HTTP Headers?
Whenever your browser requests a webpage, the server responds with the content (like HTML and images) along with invisible metadata called HTTP headers. These headers contain essential instructions for your browser on how to handle the content, how long to cache it, and what security restrictions to enforce.
Why Do Security Headers Matter?
Security headers are a crucial line of defense for web applications. They instruct the browser to lock down specific vulnerabilities. For example, Strict-Transport-Security (HSTS) ensures the browser only ever connects over encrypted HTTPS, preventing downgrade attacks. Content-Security-Policy (CSP) restricts where scripts can be loaded from, neutralizing many Cross-Site Scripting (XSS) attacks.
If a website handles sensitive data but lacks these headers, it leaves its users exposed to attacks that could otherwise be easily prevented.
Frequently Asked Questions
Does this tool support internal IP addresses?
No. To prevent Server-Side Request Forgery (SSRF) abuse, this tool blocks requests to internal network ranges (like localhost or 192.168.x.x) and only queries public-facing URLs.
Why does a site fail if it redirects?
This tool follows standard HTTP semantics. If the URL you enter responds with a 301 or 302 redirect (for example, redirecting HTTP to HTTPS), the tool displays the headers of the redirect response itself, not the final destination. You can test the destination by entering the exact final URL.
Related tools