HTTP response
Status, final URL and redirect history.
← Back to all tools
HTTP Headers Checker
Inspect response headers, redirects and the context of an HTTP request.
Understand the response
Security headers
Inspect published browser security policies.
Caching
Review cache directives and response validators.
CORS headers
View cross-origin settings in this response.
Headers depend on the URL, request method and server response. A header’s presence alone does not establish protection.
How it works
A quick look at how the HTTP Headers Checker fetches and analyses information from a website.
- Enter the exact URLProvide the full URL you want to check, including https:// when possible.
- Fetch the response headersWe send an HTTP request using your selected method and follow redirects with validation.
- Review values and findingsExplore the response headers, final URL and any redirects to understand the server’s configuration.
Frequently asked questions
Common questions about checking HTTP response headers.
Does a header’s presence mean the site is protected?
No. This check records the headers that arrived and whether a value matches the syntax it knows. It does not score protection or prove that a policy is effective.
What is the difference between CSP and Report-Only?
Content-Security-Policy is an enforcing policy. Content-Security-Policy-Report-Only monitors violations and does not apply those restrictions.
Does no-cache mean caching is disabled?
No. no-cache allows storage but requires revalidation before reuse. no-store is the directive that asks caches not to store the response. private, no-cache is not the same as caching disabled.
Does this check test CORS?
It shows Access-Control headers when they are present on this response. It does not send an Origin or a preflight, so it does not decide whether CORS is valid. Use the CORS Checker for that test.