HTTP Headers Checker
Paste a URL and see every HTTP response header: security headers, cache settings, server info, CORS headers. Faster than opening browser dev tools for a quick check.
Enter any URL to inspect its HTTP response headers. Security headers are highlighted separately. All requests are proxied server-side, so your browser never contacts the target directly.
How to check a URL's HTTP headers
Enter a URL and see the status code and every response header the server sends back.
- 01
Enter the exact URL you want to inspect
Include the path if it matters, since a home page, an image and an API endpoint can send very different headers. If you leave off the scheme, https:// is added for you.
- 02
Read the status line first
You'll see the status code and text, such as 200 OK or 301 Moved Permanently. The tool doesn't follow redirects, so a 301 or 302 shows that response and its Location header, not the final page.
- 03
Check the security headers panel
Security headers that are present are listed first, then the ones that are missing. All other headers follow in alphabetical order.
How the check is made
Our server sends a HEAD request to the URL, which asks for the headers without the page body, and waits up to 8 seconds for a reply. The request identifies itself as "Toolminex HTTP Headers Checker" and doesn't follow redirects, so you see exactly what the first server returned.
Because the request comes from our server rather than your browser, you won't see cookies or headers that depend on being logged in. A CDN may also answer from a different location than it would for you. And a few servers treat HEAD differently from GET, either refusing it with 405 Method Not Allowed or leaving out headers they'd send with the full page.
Which missing security headers actually matter
The tool lists ten security-related headers and flags any that are absent. Not all of them are worth adding. This table shows what each one does and whether a typical website needs it.
| Header | What it does | Should you set it? | Common value |
|---|---|---|---|
| Strict-Transport-Security | Forces HTTPS on return visits | Yes, on any HTTPS site | max-age=31536000; includeSubDomains |
| Content-Security-Policy | Limits where scripts, styles and frames can load from | Yes, though it takes work to get right | default-src 'self' |
| X-Content-Type-Options | Stops browsers guessing file types | Yes | nosniff |
| X-Frame-Options | Stops other sites framing yours (clickjacking) | Yes, or use CSP frame-ancestors | DENY or SAMEORIGIN |
| Referrer-Policy | Controls how much of your URL is sent to other sites | Recommended | strict-origin-when-cross-origin |
| Permissions-Policy | Turns off camera, microphone and other features | Recommended | camera=(), microphone=() |
| Cross-Origin-Opener-Policy | Isolates your window from pop-ups you open | Optional for most sites | same-origin |
| Cross-Origin-Resource-Policy | Controls which sites may load your files | Optional | same-site |
| Cross-Origin-Embedder-Policy | Needed only for features like SharedArrayBuffer | Usually not | require-corp |
| X-XSS-Protection | An old browser filter, now removed from browsers | No; leave it out or set 0 | 0 |
So don't chase a perfect score. The first four are the ones security scanners and audits care about most. X-XSS-Protection showing as missing is good news: modern browsers have dropped the filter it controlled, and setting it can cause problems in older ones.
What people check headers for
Checking caching after a deploy
Look at Cache-Control and Age on a CSS or image URL. If static files say no-store, every visit downloads them again.
Debugging a CORS error
Inspect the API URL for Access-Control-Allow-Origin. If it's missing or names a different origin, the browser will block the response.
Confirming a redirect's target
Check an old URL: you should see 301 and a Location header pointing at the new address. For the whole chain, use the Redirect Checker.
Checking an API's content type
An endpoint that returns text/html instead of application/json usually means an error page is being served instead of data.
Limits worth knowing
- It only checks public addresses our server can reach. Sites on your local network, behind a VPN or a login won't work.
- It shows a single response. Redirect chains need the Redirect Checker, which follows up to 15 hops.
- Some firewalls block automated requests and return 403, which tells you about the firewall rather than the page's normal headers.
- It doesn't grade the values. A Content-Security-Policy that allows everything still counts as present.