Network Tools

HTTP Headers Checker

Inspect HTTP response headers for any URL. View status code, security headers, and all response fields — useful for debugging and security audits.

Security Audit
Status Code
All Headers
CORS & Cache
Instant Lookup

URL

Enter a URL to inspect response headers

HTTP headers checker

HTTP response headers are key-value metadata returned by a server. They describe content type, caching, redirects, cookies, transport security, and browser permissions.

Security headers

Header	Purpose
Content-Security-Policy	Restricts executable and embedded resources
Strict-Transport-Security	Forces HTTPS
X-Frame-Options	Mitigates clickjacking
X-Content-Type-Options	Stops MIME sniffing
Referrer-Policy	Limits referrer disclosure
Permissions-Policy	Restricts browser features
Cross-Origin-Embedder-Policy	Controls cross-origin embedding

curl -I https://example.com

The checker requests the target through the site API because browsers enforce cross-origin restrictions on direct client requests. Treat results as a point-in-time observation: CDNs, redirects, authentication, and regional routing can change headers.

Interpreting results

A missing header is not automatically a vulnerability; policy depends on site content and deployment. Review CSP directives carefully before enforcing them.

Frequently Asked Questions

What are HTTP headers?: HTTP headers are key-value metadata sent with every request and response. They control caching, security, content type, authentication, encoding, and more.
What is the Content-Security-Policy header?: CSP restricts which resources a browser can load for a page, preventing XSS and data injection attacks. It is one of the most important security headers.
Why is the X-Frame-Options header important?: X-Frame-Options prevents your page from being embedded in iframes on other sites, mitigating clickjacking attacks.
What does the Strict-Transport-Security header do?: HSTS tells browsers to use HTTPS for future connections to a site, helping prevent protocol downgrade attacks. It takes effect after a browser receives the policy, unless the domain is preloaded.
How do I check HTTP response headers?: Enter an HTTPS URL and select Fetch headers. The result shows the observed HTTP status, every response header, and a check of seven common security headers.
Why can response headers change between checks?: The checker requests the target through the site API because browsers restrict direct cross-origin requests. Results are a point-in-time observation and can vary with redirects, CDNs, authentication, or region.
Does a missing security header always mean my site is vulnerable?: No. A missing security header is not automatically a vulnerability; its necessity depends on the site's content and deployment. Review policy values, especially CSP directives, in context.

Disclaimer

This tool is provided for general informational and utility purposes only. Results may be inaccurate, incomplete, outdated, or contain errors. Always verify results before relying on or using them.

Some tools may use AI, automated processing, third-party services, or server-side processing. Do not rely on these tools as a substitute for professional advice.

Use at your own risk. BestToolOnline makes no guarantees regarding the accuracy, reliability, completeness, availability, or suitability of results, to the maximum extent permitted by applicable law.

See our Terms of Service and Privacy Policy for complete details.

Loading tool...

HTTP headers checker

HTTP response headers are key-value metadata returned by a server. They describe content type, caching, redirects, cookies, transport security, and browser permissions.

Security headers

Header

Purpose

Content-Security-Policy

Restricts executable and embedded resources

Strict-Transport-Security

Forces HTTPS

X-Frame-Options

Mitigates clickjacking

X-Content-Type-Options

Stops MIME sniffing

Referrer-Policy

Limits referrer disclosure

Permissions-Policy

Restricts browser features

Cross-Origin-Embedder-Policy

Controls cross-origin embedding

curl -I https://example.com

Interpreting results

A missing header is not automatically a vulnerability; policy depends on site content and deployment. Review CSP directives carefully before enforcing them.

Frequently Asked Questions

What are HTTP headers?

HTTP headers are key-value metadata sent with every request and response. They control caching, security, content type, authentication, encoding, and more.

What is the Content-Security-Policy header?

CSP restricts which resources a browser can load for a page, preventing XSS and data injection attacks. It is one of the most important security headers.

Why is the X-Frame-Options header important?

X-Frame-Options prevents your page from being embedded in iframes on other sites, mitigating clickjacking attacks.

What does the Strict-Transport-Security header do?

HSTS tells browsers to use HTTPS for future connections to a site, helping prevent protocol downgrade attacks. It takes effect after a browser receives the policy, unless the domain is preloaded.

How do I check HTTP response headers?

Enter an HTTPS URL and select Fetch headers. The result shows the observed HTTP status, every response header, and a check of seven common security headers.

Why can response headers change between checks?

The checker requests the target through the site API because browsers restrict direct cross-origin requests. Results are a point-in-time observation and can vary with redirects, CDNs, authentication, or region.

Does a missing security header always mean my site is vulnerable?

No. A missing security header is not automatically a vulnerability; its necessity depends on the site's content and deployment. Review policy values, especially CSP directives, in context.

Disclaimer

Some tools may use AI, automated processing, third-party services, or server-side processing. Do not rely on these tools as a substitute for professional advice.