HTTP Header Checker
Fetch any URL and read every HTTP response header, with security headers, caching and compression called out. Free online header checker.
This check runs from our server, not from your browser, and is rate limited. Nothing you enter is stored. Private and internal addresses are refused on purpose.
What this tool is for
Headers decide how a page is cached, whether it is compressed, and how much of the browser security model applies to it. This shows all of them as the server sent them, and highlights the security headers that are present or missing, which is the cheapest hardening review available. This is one of the few tools here that needs a server, because the question is about the internet rather than about your data. The request is made from our server, rate limited, and nothing you enter is stored.
How to use it
- Enter a URL.
- Read the full header list exactly as returned.
- Check the security header summary: each missing one is a decision, not an accident.
Frequently asked questions
Which security headers actually matter?
Content-Security-Policy is the strongest and the fussiest. Strict-Transport-Security locks the site to HTTPS. X-Content-Type-Options and Referrer-Policy cost nothing and should always be set.
My caching header looks right but nothing is cached.
Check for a Set-Cookie on the same response: many caches refuse to store a response that sets a cookie. Also check Vary, which fragments the cache once it lists too much.