HTTP Header Inspector
ServerFetch a URL's response headers (CORS-free).
Fetched server-side, so it works for any URL regardless of CORS.
About the HTTP Header Inspector
HTTP response headers control caching, security, redirects and content type. This free HTTP header checker fetches any URL server-side (so there are no CORS limits) and shows its full response headers, status code and HTTP version.
It's ideal for debugging security headers, cache rules and redirects.
What you can inspect
- Status code and HTTP version.
- Security headers like Content-Security-Policy, HSTS and X-Frame-Options.
- Caching headers such as Cache-Control and ETag.
- Content-Type, Server and redirect Location headers.
Headers worth checking
- Security — Strict-Transport-Security, Content-Security-Policy, X-Frame-Options.
- Caching — Cache-Control, ETag, Expires.
- Content — Content-Type and Content-Encoding.
- Redirects — the Location header and the status code chain.
Frequently asked questions
What are HTTP response headers?
Metadata a server sends with a response — controlling things like content type, caching, security policies and redirects — separate from the page content itself.
Why fetch headers server-side?
Browsers block cross-origin header reads (CORS), so fetching from the server side lets you inspect any public URL's headers without those restrictions.
Which security headers should I look for?
Common ones include Strict-Transport-Security, Content-Security-Policy, X-Content-Type-Options and X-Frame-Options, which harden a site against several attacks.
Why fetch headers from a server instead of the browser?
Browsers block cross-origin header reads for security (CORS), so you can't inspect another site's headers from your own page's JavaScript. Fetching server-side sidesteps that and shows the real response for any public URL.