Free HTTP header inspector — see a URL’s response headers, security headers, and caching behavior.
Every other tool on this site runs entirely as JavaScript in your browser and never contacts a server at all. This one is a deliberate exception, by necessity: the URL you enter is requested by our server on your behalf, the same as visiting it in a browser — unavoidable, since browsers restrict which response headers JavaScript can read directly — nothing about the request is logged. Nothing about the request is logged, stored, written to a cookie, or shared with any third party — it's handled and discarded the moment the response is sent back to you.
This describes only what this specific tool does with what you type into it. It doesn't cover the rest of this site — see the Privacy Policy for how analytics and advertising cookies are handled elsewhere.
Enter a URL and see every HTTP response header it returns — security headers, caching directives, server information, and redirect behavior — without opening your browser's developer tools.
This is server-proxied rather than run directly from your browser, since a browser's own fetch() strips many headers from what JavaScript is allowed to read back, regardless of whether the target site allows cross-origin requests — reading the complete, real header set needs a server-side request.
Useful for checking whether a site sets recommended security headers (like Content-Security-Policy or Strict-Transport-Security), debugging caching behavior, or seeing where a URL redirects to before it reaches its final destination.
Browsers deliberately restrict which response headers JavaScript can read back from a fetch() call, regardless of the site’s CORS settings — reading the complete, unfiltered header set needs a server-side request instead.
Yes — it follows redirects to their final destination and shows you the headers from that final response, along with the URL it actually landed on.
Headers like Content-Security-Policy, Strict-Transport-Security, and X-Frame-Options tell browsers how to handle a site more safely — missing ones aren’t necessarily a problem, but they’re commonly checked during a basic security review.
It requests exactly the URL you enter, the same as visiting it in a browser — nothing else is contacted, and nothing about the request is logged beyond what’s needed to return the result to you.