HTTP Header Inspector

Fetch and inspect HTTP response headers for any URL — status code, security headers, caching, CORS and more. Fetched from the edge, so no browser CORS restrictions.

Enter a URL above and click Inspect
📋

Inspect HTTP response headers

Enter any URL to see the raw headers the server returns — security headers, cache-control, content-type, CORS, and more.

What to look for
🔐
HSTS
strict-transport-security — forces HTTPS for all future visits.
🛡️
CSP
content-security-policy — restricts which resources the page can load.
🖼️
X-Frame-Options
Prevents clickjacking by blocking the page from being embedded in iframes.
🐢
Cache-Control
Controls how browsers and CDNs cache the response. Debug stale deployments here.
🌐
CORS
access-control-allow-origin — which origins can read this response.
HTTP status codes
✅
2xx — Success
200 OK, 201 Created, 204 No Content.
↪️
3xx — Redirect
301/302 redirect. Check location header for destination.
⚠️
4xx — Client error
403 Forbidden, 404 Not Found, 429 Rate Limited.
❌
5xx — Server error
500 Internal Server Error, 503 Unavailable.