About this tool
Inspect HTTP response headers of any URL, including security headers like CSP and HSTS, caching directives, and server configuration signals.
- Enter the URL whose response headers you want to inspect.
- Review security headers such as Content-Security-Policy, HSTS, and X-Content-Type-Options.
- Check caching headers and server fingerprints before shipping configuration changes.
Frequently asked questions
- Which security headers matter most?
- Content-Security-Policy limits what scripts a page may load, Strict-Transport-Security forces HTTPS, X-Content-Type-Options stops MIME sniffing, and Referrer-Policy limits data leakage via referrers. Missing CSP and HSTS are the most common findings.
- What does a missing HSTS header mean?
- Browsers may still connect over plain HTTP on the first visit, allowing downgrade attacks. Adding Strict-Transport-Security with a long max-age closes that gap once HTTPS is stable.
- Are Cache-Control headers case sensitive?
- No. HTTP header names are case-insensitive, so cache-control and Cache-Control behave identically, though consistent casing keeps configs readable.