HTTP Header Viewer - Free Online Header & Security Analyzer
Fetch and analyze HTTP response headers from any website. Check security headers like CSP and HSTS, review caching and content-type configuration, and get an instant security score - free, with no signup required.
HTTP Header Analyzer
Fetch and analyze HTTP response headers from any website
7 Security Headers Checked
CSP, HSTS, X-Frame-Options, and more
Response Time & Status
See exactly how the server responded
Auto-Categorized
Security, content, cache, and server headers
Exportable Report
Download the full analysis as a text file
What Are HTTP Headers?
HTTP headers are key-value pairs sent between browsers and servers as part of every web request and response. They carry metadata that never appears on the page itself but controls how the browser handles the response - what caching policy to apply, what security restrictions to enforce, what content type to expect, and which server or CDN generated the response.
Response headers fall into a few broad categories: security headers (like Content-Security-Policy and Strict-Transport-Security) that instruct the browser on what to trust and how to protect the user; content headers (like Content-Type and Content-Encoding) that describe the payload; caching headers (like Cache-Control and ETag) that control how long and how a response can be reused; and server headers that reveal information about the backend infrastructure serving the request.
This tool fetches the real response headers for any public URL and categorizes them automatically, giving you a fast way to audit a site's security posture, debug caching behavior, or simply see what a server is telling browsers about a page.
How to Use the HTTP Header Viewer
- 1
1. Enter a URL
Type or paste any public website URL. If you omit the protocol, https:// is added automatically.
- 2
2. Click Analyze
The tool fetches the live response headers for that URL and displays the HTTP status code, response time, total header count, and an overall security score.
- 3
3. Browse by Category
Headers are automatically sorted into Security, Content, Cache, Server, and Other tabs, so you can jump straight to the category you care about instead of scanning a raw list.
- 4
4. Search for a Specific Header
Use the search box to filter by header name or value - useful for quickly checking whether a specific directive like max-age or nosniff is present.
- 5
5. Review the Security Checklist
The Security Header Analysis section checks for seven key OWASP-recommended headers and marks each as present or missing, so you can see gaps at a glance.
- 6
6. Copy or Export
Copy any individual header value to your clipboard, or export the full analysis - URL, status, timing, security score, and every header - as a downloadable text file.
The 7 Security Headers This Tool Checks
Content-Security-Policy (CSP)
Restricts which sources scripts, styles, images, and other resources can be loaded from, making it one of the strongest defenses against XSS and data-injection attacks.
Strict-Transport-Security (HSTS)
Tells browsers to only ever connect to the site over HTTPS for a specified duration, preventing protocol-downgrade and man-in-the-middle attacks on future visits.
X-Frame-Options
Controls whether the page can be embedded in an iframe on another site, protecting against clickjacking attacks. Modern sites increasingly use the CSP frame-ancestors directive for the same purpose.
X-Content-Type-Options
Set to nosniff, this stops browsers from trying to guess ("sniff") a resource's MIME type, preventing certain content-type confusion attacks.
Referrer-Policy
Controls how much URL information is sent in the Referer header when users navigate away from the page, limiting accidental leakage of sensitive query parameters or internal paths.
Permissions-Policy
Lets a site explicitly enable or disable browser features and APIs (camera, microphone, geolocation, and more), reducing the attack surface exposed to third-party scripts.
X-XSS-Protection
A legacy header that enabled a browser's built-in XSS filter. Modern browsers have largely removed this filter in favor of CSP, but the header is still checked for compatibility with older clients.
Header Categories Explained
| Category | Example Headers | What It Controls |
|---|---|---|
| Security | CSP, HSTS, X-Frame-Options, X-Content-Type-Options | Browser-enforced protections against XSS, clickjacking, and protocol downgrade attacks |
| Content | Content-Type, Content-Encoding, Accept-* | How the response body should be parsed, decoded, and rendered |
| Cache | Cache-Control, ETag, Expires, Last-Modified | Whether and how long browsers and CDNs can reuse a cached response |
| Server | Server, X-Powered-By, Via | What backend software, framework, or proxy generated the response |
| Other / Custom | X-Request-Id, X-RateLimit-*, app-specific headers | Application-specific metadata not covered by the standard categories |
Common Use Cases for HTTP Header Analysis
Security Audits
Quickly check whether a production site has the OWASP-recommended security headers in place before a launch, penetration test, or compliance review.
Debugging Caching Issues
Inspect Cache-Control, ETag, and Expires values to understand why a resource isn't being cached - or is being cached longer - than expected.
CDN & Reverse Proxy Verification
Confirm that a CDN, load balancer, or reverse proxy is correctly forwarding or adding headers like Via, X-Cache, or custom routing headers.
SEO & Content-Type Checks
Verify Content-Type and charset declarations are correct, and confirm compression (Content-Encoding: gzip/br) is enabled for faster page loads.
Competitive Research
See what server stack, CDN, or security configuration a competitor or reference site is using, without needing access to their infrastructure.
API Response Debugging
Inspect rate-limit headers, CORS headers, and custom API metadata headers when integrating with or debugging a third-party API.
How the Security Score Is Calculated
The security score checks for the presence of seven widely recommended security headers - Strict-Transport-Security, X-Frame-Options, X-Content-Type-Options, X-XSS-Protection, Content-Security-Policy, Referrer-Policy, and Permissions-Policy - and expresses the proportion present as a percentage. A score of 100% means all seven headers were detected in the response; lower scores highlight specific gaps you can address.
This is a presence check, not a full grading of each header's configuration quality - a site can have a Content-Security-Policy header present but still configured too loosely (for example, allowing 'unsafe-inline' scripts) to meaningfully block XSS. Treat a high score as a good starting signal, and review each header's actual value for weak or overly permissive settings as a next step.
Key Features
Frequently Asked Questions
Why can't I fetch headers for some websites?
Some sites block automated requests, sit behind authentication, or enforce strict CORS and bot-protection policies that prevent header retrieval. The tool works best on publicly accessible pages.
Is a 100% security score the same as "fully secure"?
No. The score reflects whether seven recommended headers are present, not whether each is configured optimally. A site can have every header present but still have a weak Content-Security-Policy or short HSTS max-age.
What's the difference between X-Frame-Options and CSP frame-ancestors?
Both prevent a page from being embedded in another site's iframe. X-Frame-Options is the older, simpler header; the CSP frame-ancestors directive is the modern replacement with more flexible source-matching, and takes precedence in browsers that support it.
Why does the Server header sometimes say "Unknown"?
Many servers and CDNs deliberately omit or obscure the Server header as a security-through-obscurity measure, so there is simply no value to report.
Can I use this to check my own site before launch?
Yes. Running your production URL through this tool before launch is a quick way to confirm caching headers, content types, and security headers are all configured as intended.
Does this tool store the URLs I analyze?
The tool fetches headers on demand to display results in your browser session. No history of analyzed URLs is shown to other visitors, and results reset when you start a new analysis or leave the page.
Related Tools
Discover more free developer tools that might interest you.
Reverse IP Lookup
Resolve an IPv4 address to its reverse DNS PTR hostname
Use ToolDNS Record Lookup
Look up DNS records for domains
Use ToolLighthouse Score Simulator
Estimate a Lighthouse-style performance score from page metrics
Use ToolDomain to IP
Convert domain names to IP addresses
Use ToolPing Test
Test network connectivity and latency
Use ToolSSL Certificate Checker
Check SSL certificate details and validity
Use ToolRelated guides
Read the how-to, then come back to this tool when you are ready to run it locally.
- Why Chrome Says “Not Secure” (and What to Check First)HTTP pages, mixed content, name-mismatch certificates, and expired TLS. How to tell a padlock problem from a DNS problem without scanning hosts you do not own.
- How to Check Security Headers on a Live SiteCSP, HSTS, X-Frame-Options, cookies, and noindex - what to look for in HTTP headers, how a header viewer helps, and what it will never prove.
- Why Your DNS Change Isn’t Showing YetYou updated A or CNAME records but the site still hits the old server. TTL, cache, recursive resolvers, and how to look up public DNS without confusing it with your laptop’s cache.