HTTP Headers Inspector

Analyze the precise HTTP response headers served by any URL to validate security headers, caching directives, and server software details.

Security policies Cache-Control headers Server and software info
Public HTTP and HTTPS targets only.

Inspect raw HTTP response headers

Enter a URL in the field above to get started. You will see the exact key-value pairs returned by the server, exposing how it instructs browsers and proxies to handle the content.

When to use this

Confirming Strict-Transport-Security (HSTS) and Content-Security-Policy (CSP) headers.

Debugging CDN cache hits, misses, and expiry times.

Checking API rate limit headers and server software versions.

Monitor header compliance?

Set up assertions to receive alerts if crucial security headers disappear or caching policies change unexpectedly.

Start monitoring free

Frequently Asked Questions

Security headers instruct the browser on how to handle the page, protecting against vulnerabilities like XSS, clickjacking, and mime-sniffing.

Headers like Cache-Control and Expires tell browsers and intermediary CDNs whether a resource can be cached, and for exactly how long.

Yes. Headers like X-Powered-By or Server can reveal specific software versions, giving potential attackers clues about your stack. It is best practice to remove or obscure them.