HTTP Header Checker

Fetches all HTTP response headers from any domain — status code, server software, cache-control, and security headers including HSTS and Content-Security-Policy.

More Tools

HTTP Header Checker — View HTTP Response Headers from Any Domain

HTTP Header Checker sends an HTTP HEAD request (RFC 9110) to any public domain and returns the complete set of response headers the web server sends back. Response headers are key-value pairs that communicate the server's software identity, content type, caching policy, compression method, and security configuration. Results include the HTTP status code, Content-Type, Cache-Control, Server, Content-Encoding, and all security headers — Strict-Transport-Security (RFC 6797), X-Frame-Options (RFC 7034), and Content-Security-Policy.

Fact	Value
Request method	HTTP HEAD — headers only, no response body transferred
Protocol order	HTTPS (port 443) first, HTTP (port 80) fallback
RFC reference	RFC 9110 — HTTP Semantics (June 2022)
Key security headers	HSTS · CSP · X-Frame-Options · X-Content-Type-Options
Data retention	None — results not stored or logged

What HTTP Response Headers Are Returned?

The table below covers the response headers most commonly returned by web servers. Headers with lowercase names indicate an HTTP/2 response — HTTP/2 mandates lowercase header names per RFC 9113. Headers prefixed with x- are non-standard extensions added by specific servers, CDNs, or frameworks.

Header	Purpose	Security Relevance
`content-type`	Media type and character encoding of the response body	—
`content-encoding`	Compression applied to the body — gzip, br (Brotli), zstd	—
`cache-control`	Browser and CDN caching rules — max-age, no-store, public, private	`no-store` required for responses containing sensitive data
`server`	Web server software identifier — nginx, Apache, cloudflare	Exposing version numbers is an information disclosure risk
`strict-transport-security`	HSTS — instructs the browser to use HTTPS only (RFC 6797)	Required for A-grade security posture — missing is a critical gap
`x-frame-options`	Controls iframe embedding to prevent clickjacking (RFC 7034)	DENY or SAMEORIGIN recommended
`content-security-policy`	Restricts which resource origins the browser may load	Prevents XSS and data injection attacks — most common audit finding
`x-content-type-options`	Blocks MIME-type sniffing by the browser	`nosniff` value required
`referrer-policy`	Controls referrer data sent to third-party origins	`strict-origin-when-cross-origin` recommended
`set-cookie`	Sets browser cookies — inspect for Secure and HttpOnly attributes	Missing `Secure` flag = cookie transmitted over plain HTTP

How to Use the HTTP Header Checker

Fetch all HTTP response headers from any domain in seconds.

Enter Domain Name

Enter a domain or URL — e.g. example.com or https://example.com. The tool strips the protocol and path automatically, querying only the hostname.

Submit the Request

Click Check HTTP Headers to send a live HEAD request from our server to the target domain on port 443 (HTTPS first, with HTTP fallback to port 80).

Read the Header Table

Review the header table — each row is one HTTP response header name and its value returned by the server in reply to the HEAD request.

Check Security Headers

Look for Strict-Transport-Security, Content-Security-Policy, X-Frame-Options, and X-Content-Type-Options. Missing security headers indicate server hardening opportunities.

Do it yourself

How to Check HTTP Response Headers Without an Online Tool

HTTP response headers can be fetched from any terminal using curl. The -I flag sends a HEAD request — identical to what this tool performs. Use -sD - -o /dev/null to send a GET request and display only the headers, which surfaces any headers a server omits from HEAD responses.

Windows Command Prompt (curl available on Windows 10 build 17063 and later)

curl -I https://example.com

GET-based inspection — reveals headers that may differ from HEAD response:

curl -sD - -o /dev/null https://example.com

Windows PowerShell

(Invoke-WebRequest -Uri "https://example.com" -Method Head).Headers

Mac / Linux curl

curl -I https://example.com

The online tool queries from an external server in a neutral location. Results may differ from a local curl command if a CDN serves different headers based on client IP geolocation or network path.

HTTP Security Headers — What to Look For in Your Results

Security headers are HTTP response headers that instruct the browser how to handle the server's content and which actions to block. Their absence is the most frequently reported finding in web application security audits. Check your results for these four critical entries:

Strict-Transport-Security (RFC 6797) — instructs the browser to connect only via HTTPS for the duration defined by max-age. Recommended value: max-age=31536000; includeSubDomains; preload. This header is absent on servers not configured for HTTPS — its presence confirms the server actively enforces encrypted connections.
Content-Security-Policy — restricts which scripts, stylesheets, fonts, and API endpoints the browser may load for the page. A missing CSP is the single most common critical finding in third-party web security audits and prevents cross-site scripting (XSS) and data injection attacks.
X-Frame-Options (RFC 7034) — controls whether the page can be loaded inside an iframe on another domain. DENY blocks all embedding; SAMEORIGIN permits embedding only from the same origin. Prevents clickjacking attacks that trick users into interacting with hidden frames.
X-Content-Type-Options — set to nosniff to prevent browsers from interpreting files as a MIME type other than the one declared in Content-Type. Blocks MIME confusion attacks where a crafted file is executed as a different type than intended.

Common Uses for HTTP Response Header Checking

Post-deployment security verification. A web developer deploys a new nginx configuration with HSTS and CSP directives and needs to confirm the headers are active before removing the HTTP listener. They enter the domain, confirm strict-transport-security: max-age=31536000; includeSubDomains is present, and verify content-security-policy and x-frame-options are also set before marking the deployment complete.

CDN cache verification. A DevOps engineer suspects a CDN configuration change broke caching after a deployment. They check the cache-control, x-cache, and age headers to confirm whether responses are originating from the CDN edge or bypassing it to the origin server, and verify the max-age directive matches the intended caching policy.

Third-party security audit. A security analyst checking a client's production domain finds that Content-Security-Policy, X-Frame-Options, and X-Content-Type-Options are all absent from the response headers. They document the three missing headers, reference OWASP Secure Headers Project recommendations for each, and use the findings to build the remediation priority list for the engineering team.

Frequently Asked Questions

What does the HTTP Header Checker return?

HTTP Header Checker returns every response header sent by the web server in reply to an HTTP HEAD request — including the status code, Content-Type, Cache-Control, Content-Encoding, Server software identifier, and all security headers present. Each header is a key-value pair defined in RFC 9110. The full set reflects the live server configuration at query time.

How accurate are the HTTP response headers shown?

Accuracy is 100% for the headers the server actually returns — they are fetched live and not cached. The caveat: some servers return a different header set for HEAD requests than for GET requests. If a security header appears absent, confirm with curl -I https://yourdomain.com in a terminal to perform an independent comparison.

What are the most important HTTP security headers to check?

Six headers define a strong server security posture: Strict-Transport-Security (HSTS, RFC 6797) enforces HTTPS-only connections; Content-Security-Policy (CSP) restricts resource origins to prevent XSS; X-Frame-Options (RFC 7034) blocks clickjacking via iframe embedding; X-Content-Type-Options prevents MIME-type sniffing; Referrer-Policy controls referrer data sent to third-party origins; and Permissions-Policy limits browser API access. A missing HSTS header is a critical security gap.

Why are some HTTP headers missing from my results?

Three common causes: (1) the header is genuinely absent — not configured on the server; (2) the server returns a different header set for HEAD versus GET requests — some CDNs and application frameworks omit headers on HEAD; (3) a reverse proxy or CDN (Cloudflare, AWS CloudFront) strips or modifies headers before they reach the client. Cross-check with curl -I https://yourdomain.com to confirm whether the header exists at the origin.

What is the difference between HTTP request headers and HTTP response headers?

Request headers are sent by the client to the server — for example, User-Agent, Accept-Encoding, and Accept-Language — and describe the nature of the request and the client's capabilities. Response headers are returned by the server to the client — for example, Content-Type, Cache-Control, and Strict-Transport-Security — and describe the server's configuration and the nature of the response. This tool displays response headers only: what the server sends back, not what was sent to it.

Do you store or log the domains I check?

No. Each HTTP header check is performed in real time on our server and the result is returned directly to your browser. The domain entered and the headers returned are not stored, logged, or associated with any session or account data. Results exist only for the duration of your current session.

VPNs encrypt traffic between the client and the VPN server, but HTTP response headers from the destination website — including HSTS and CSP — remain unchanged and visible. Understanding both the transport layer and the header layer is essential for evaluating the full security posture of a web connection.

Guide What Is a Proxy Server and How Does It Work?

Reverse proxies such as nginx, HAProxy, and Cloudflare are the most common place where HTTP security headers are added, modified, or stripped before a response reaches the client. If headers appear in a direct curl test but not in this tool's results — or vice versa — a reverse proxy is the most likely cause.