HTTP Header Checker
HTTP Header Checker lets you see every response header a URL returns, including caching, content type, and CORS, and get findings for four missing security headers.
- check_circlePublic pages only
- check_circle1 global credit
- check_circleNo setup required
Public webpages only
Run HTTP Header Checker
- 01Add source
- 02Set options
- 03Review result
Analyze public content you own or have permission to inspect, and follow the source site's terms. Failed and cancelled runs automatically return reserved credits.
Complete
Results
What HTTP Header Checker does
The HTTP header checker sends a safe request to a public URL and displays the response headers it receives. The table lists every header with its value. Findings flag four security headers when they are missing: Content-Security-Policy, Strict-Transport-Security, X-Content-Type-Options, and Referrer-Policy. The request asks for an uncompressed response, so the result does not show compression.
The report shows each raw header name and value as the server sent it. This lets developers verify the live server response without treating a generic checklist as a substitute for the site's actual security model.
HTTP Header Checker features
Useful fields from the start
Review response headers, security findings, caching headers, content type in one organized result.
Export as CSV, XLSX, JSON
Formats offered: CSV, XLSX, JSON.
Where HTTP Header Checker fits
Perfect for
- checkConfirm caching after a CDN change
- checkSee the cache and server headers a CDN adds
- checkReview security headers on a new app
- checkDebug content type or CORS behavior
What you get
- checkResponse headers
- checkSecurity findings
- checkCaching headers
- checkContent type
How to use HTTP Header Checker
- 01
Enter the public URL
Use the exact page or resource whose response headers you need.
- 02
Review raw values and findings
Read the header table and any missing security header findings.
- 03
Update the serving layer
Change the application, web server, or CDN configuration and request the URL again.
Before you run HTTP Header Checker
- infoHeader needs differ between documents, APIs, fonts, and media files.
- infoA missing header is not automatically a vulnerability.
- infoThe result reflects one live response and may vary by region or cache state.
Questions about HTTP Header Checker
Something missing? Ask us.
Which security headers are checked?
Can it check API responses?
Does passing every header check make a site secure?
Ready when you are
Run HTTP Header Checker
Analyze a public page to inspect response headers and security findings.
Open the tool