HTTP Headers Checker
View HTTP response headers for any URL. Inspect security headers, copy all headers, copy as curl command.
About this tool
Every HTTP response carries a set of headers — metadata such as Content-Type, Cache-Control, Strict-Transport-Security, Server, and X-Frame-Options — that tell the browser and any intermediary how to handle the body. This tool fetches a URL and lists every header the server actually returned, alongside the status code and elapsed time.
It is the quickest way to verify that a redirect is in place, confirm a security header such as Content-Security-Policy is being sent, or debug why a browser is caching stale assets. Enter https://example.com and the report shows 200 OK, the server (ECS), age, and cache miss/hit indicators.
Requests are routed through a CORS proxy because browsers block cross-origin header reads; the headers shown are exactly what the origin server sent to that proxy.
FAQ
Why do I see different headers than curl shows? ›
The request goes through a proxy, so some CDNs add headers like X-Cache or Via that reflect the proxy hop. Origin-only headers (those guarded by Access-Control-Expose-Headers) may also be hidden from the browser.
Can it follow redirects? ›
The tool reports the final response after redirects. Each hop adds its own headers, but only the last one is displayed — check the status code to spot a 301/302 that resolved to a 200.
Does it send cookies or auth? ›
No. The request is anonymous and unauthenticated, which is why protected endpoints may return 401 or 403. Use it to inspect public-facing behaviour, not authenticated flows.