HTTP Response Headers Inspector
Fetch any URL and inspect its response status, content type, security headers, and caching directives.
About This Tool & Technical Logic
HTTP response headers carry the instructions browsers actually obey: security policy (HSTS, CSP, X-Frame-Options), caching (Cache-Control, ETag), compression, and content negotiation.
The inspector fetches your URL through a CORS relay and reports what came back. Headers worth auditing quarterly: HSTS (forces HTTPS), CSP (the strongest XSS defense), and X-Content-Type-Options — their absence is a finding on most security scans.
Relayed fetch of the target URL; status, content-type, and security-relevant headers extracted and classified.
How to Use — Step by Step
- 1
Enter a full URL
Include https:// — the scheme matters both for the request and for which security headers apply.
- 2
Review the security section
Green = present. Missing HSTS or CSP flags where to harden; server-exposing headers (X-Powered-By) should be removed.
- 3
Check caching directives
Cache-Control and ETag govern how CDN and browsers reuse responses — misconfigured caching is a common silent performance killer.
Frequently Asked Questions
Strict-Transport-Security tells browsers to refuse plain HTTP to your site for a stated period — closing downgrade and cookie-hijacking attacks.