HTTP Headers Checker

Fetch a URL and inspect the full HTTP response: status code, response time, whether redirects occurred, final URL, and every response header sorted alphabetically. Use it to verify security headers (Content-Security-Policy, Strict-Transport-Security, X-Frame-Options), caching directives (Cache-Control, ETag), server identifiers, and CDN behavior. Requests run from the ToolsLibrary network API — results reflect what that server receives, which may differ from your browser if geo or bot rules apply.

How to Use the HTTP Headers Checker

Enter a public URL to fetch response headers, status code, latency, redirect behavior, and the final URL.

  1. Open HTTP Headers Checker.
  2. Enter a URL or hostname (https://example.com recommended).
  3. Click Fetch headers to run the server-side HTTP request.
  4. Read the status badge (for example 200 OK) and Latency tile.
  5. Check whether Redirected is Yes and confirm Final URL matches expectations.
  6. Scroll the Header / Value table — headers are sorted alphabetically for scanning.
  7. Look for security headers (CSP, HSTS), caching (Cache-Control), and Server identifiers.

Reading response headers

Response headers are metadata the server (or CDN) attaches to an HTTP reply. They control caching, security policy, cookies, content type, and redirect hints. This tool captures them after redirect following completes.

Worked example

  • Verify HSTS — Strict-Transport-Security with max-age after enabling HTTPS site-wide.
  • CDN cache — Cache-Control: public, max-age=31536000 on static assets; shorter TTL on HTML.
  • Clickjacking defense — X-Frame-Options DENY or CSP frame-ancestors 'self' on admin pages.

Common mistakes

  • Checking a login-only page without authentication — you may see 302 to login, not production headers.
  • Expecting identical headers worldwide — CDNs vary by PoP and cache state.
  • Confusing missing CSP with insecure site — many sites use other layers; CSP is one control among many.

Limitations

Single GET from one server location. No header editing, method override, or cookie jar. Pair with SSL Certificate Checker for TLS certificate details.

FAQ

Which security headers should I look for?

Common ones include Strict-Transport-Security (HSTS), Content-Security-Policy (CSP), X-Frame-Options or frame-ancestors, X-Content-Type-Options, and Referrer-Policy. Presence and values depend on your security policy.

Does this send custom request headers?

No. The probe uses default client headers from the server-side fetch. It cannot simulate your browser cookies or Authorization tokens unless the endpoint is public.

Why is Redirected Yes but status is 200?

The tool reports the final response after following redirects. Redirected Yes means intermediate 301/302 responses occurred before the final 200.

Can I inspect request headers my browser sends?

This tool shows response headers from the server. For outbound request control use browser DevTools or API Request Tester.

Why are some headers missing compared to curl -I?

Different clients, HTTP versions, and redirect paths change which headers appear. Bot protection may also strip or alter headers for non-browser agents.

Where does the fetch originate?

From the ToolsLibrary /api/network/headers endpoint on the server — not from your local machine.

Can this validate CSP or HSTS configuration?

It displays raw header values for manual review. Automated CSP/HSTS scoring requires dedicated security scanners.

Does it show response body content?

No — headers, status, latency, redirect flag, and final URL only. Use browser DevTools or API Request Tester for body inspection.

Why might Server header reveal software versions?

Some stacks advertise Server or X-Powered-By. Security best practice is to minimize version disclosure — this tool helps you audit what leaks publicly.

Is header inspection allowed on any URL?

Use only on URLs you own or may legitimately test. Do not use header fetching to bypass access controls or probe unauthorized systems.