What are HTTP response headers?

HTTP response headers are metadata sent by a web server alongside a response. They control caching, content type, security policies, redirects, and CORS.

What security headers should every website have?

The most important security headers are: Strict-Transport-Security (HSTS), Content-Security-Policy (CSP), X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy.

HTTP Inspector

HTTP Headers Lookup

Inspect response headers, trace redirect chains, and audit security headers for any URL.

Try:

Related Tools

⊛

SSL Certificate Checker

Check any website's SSL certificate: expiry date, issuer, domain coverage, chain validity. Instant, free.

⊚

Website Speed Checker

Test your website's server response time, DNS lookup, TCP connect, TLS handshake, and time to first byte (TTFB) from our server.

⊙

Website Status Checker

Check if a website is up or down right now. Tests from our server independently of your connection — instant, free.

HTTP Headers — What They Tell You

Every HTTP response includes headers controlling caching, security, redirects, and CORS. Inspecting them is essential for debugging web performance and security misconfigurations.

Cache-Control

Tells browsers and CDNs how long to cache a response. max-age=31536000 caches for one year; no-store prevents caching entirely.

Redirect Chains

Multiple redirects slow page load. This tool follows each 301/302/307/308 hop and shows the full chain with status at each step.

Security Headers Score

Missing security headers are among the most common web vulnerabilities. This tool checks for the six most important and gives you a score.

CORS Headers

The Access-Control-Allow-Origin header controls which domains can make cross-origin requests. Misconfigured CORS headers are a common cause of frontend API errors.