What the HTTP Header Checker does
Every time a server answers a request it sends back HTTP response headers — metadata that controls caching, security, content type, compression and more. Browsers act on these silently, but they are invaluable when you are debugging a site or auditing its configuration.
This tool fetches a URL and lists the response headers it returns, so you can confirm security headers are present, check caching behaviour, and see what server software is in use.
How to read the results
- content-type — the format of the response (e.g. text/html; charset=utf-8).
- cache-control / etag — how and how long the response may be cached.
- strict-transport-security, content-security-policy, x-frame-options — security headers that harden the site.
- server — the web-server software, when it is disclosed.
- location — the target of a redirect, if the URL redirects elsewhere.
Worked example
Input: https://example.com
content-type text/html; charset=UTF-8 cache-control max-age=1800 content-encoding gzip
This tells you the page is HTML, may be cached for 30 minutes (1800 seconds), and is served gzip-compressed. Note that some hosts hide sensitive headers from cross-origin requests.
Common use cases
- Verify security headers (HSTS, CSP, X-Frame-Options) are configured.
- Debug caching by inspecting Cache-Control and ETag values.
- Confirm the correct Content-Type is being served.
- Check whether a URL redirects and where it points.
- Identify the server software or CDN behind a site.