📋 HTTP Header Inspector

Enter any URL to fetch and inspect its HTTP response headers — status code, security headers, caching, and more.

ℹ️ Uses a CORS proxy to fetch headers from external URLs. No request content is logged.

When to use this

🔐
Check security headersVerify that CSP, HSTS, X-Frame-Options, and other security headers are set correctly on your site before going live.
🐢
Debug caching issuesInspect Cache-Control, ETag, and Expires to understand why a page isn't updating for users after a deploy.
↪️
Trace redirectsSee the final URL and status code after all redirects resolve — useful for checking canonicalization and HTTPS enforcement.
🌐
Diagnose CORS errorsCheck if the server returns the correct Access-Control-Allow-Origin header that your app expects.

Key headers

HSTS — forces HTTPS for all future visits
CSP — restricts what resources the page can load
X-Frame-Options — prevents clickjacking
Cache-Control — controls browser and CDN caching