Skip to content
Deepak Paswan Logo
DEEPAK PASWAN
Developer Software
View all Developer Software tools
Image Tools
View all Image Tools
PDF Tools
View all PDF Tools
SEO / Search
View all SEO / Search tools
Network & DNS
Handpicked Developer Utilities, SEO Analyzers, and Conversion Tools (84+ directory)
View All Tools (85+ Directory)

HTTP Response Headers Checker

Fetch a URL and see its response headers grouped into security, caching, content, server and other. Check HSTS, CSP, cache-control and more.

Inspect server response headers, caching directives, and security policies.

What this tool does

Enter a URL and the tool fetches it and lists the response headers, sorted into groups: Security, Caching and validation, Content, Server and infrastructure, CORS and Other. It’s quicker to read than the raw output of curl -I.

Headers worth looking at

Security

  • Strict-Transport-Security (HSTS) tells browsers to use HTTPS only.
  • Content-Security-Policy restricts where scripts, styles and frames can load from.
  • X-Content-Type-Options: nosniff stops browsers guessing file types.
  • X-Frame-Options or CSP frame-ancestors control embedding in frames.
  • Referrer-Policy and Permissions-Policy limit what is shared and which browser features can be used.

Caching

  • Cache-Control, ETag, Last-Modified and Expires decide how long browsers and CDNs keep a copy. A missing or no-store policy on static files is a common reason for poor repeat-visit speed.

Server

  • Server, X-Powered-By and similar headers sometimes reveal software and versions. Hiding version numbers is sensible hygiene, though it is not a defence by itself.

What the tool can and can’t see

It reads the headers returned to this site’s server, for one request to the URL you gave. A CDN or firewall might send different headers to a browser, and logged-in pages can differ. It doesn’t grade your security setup, so a missing header isn’t automatically a fault. Whether you need a given header depends on the site.

Results are cached for 15 minutes, and you can run up to 15 checks a minute.

If a page redirects, you see the headers of the final page. For each hop, use the redirect checker.

Does a missing security header mean my site is insecure?

Not by itself. It means that protection isn’t configured. Decide which ones your site needs.

Why do headers differ from what my browser shows?

The request comes from this site’s server. A CDN or firewall can answer it differently than it answers your browser.

Does it show headers from every redirect hop?

No, only the final response. The redirect checker shows each hop.

Can it tell me my site’s grade?

No. It lists and groups headers but doesn’t score them.

How long are results cached?

For 15 minutes, and up to 15 checks a minute are allowed. After a server change, an immediate re-check can show the earlier headers.