HTTP Headers Viewer
Free online HTTP Headers Viewer that runs directly in your browser.
-
1Enter data
Enter content, paste text or load a file from disk. -
2Click the button
The tool will immediately process your data in the browser. -
3Get the result
Copy the finished text or save the file to your device.
return "Result ready in 0.1s";
}
Rate this tool:
Related tools
Other tools you may find usefulHTTP Header Viewer - Analyze Server Response
Tool forHTTP Header Viewersends a HEAD request to the given URL and displays the full list of server response headers. Useful for auditing server configuration, diagnosing cache problems, and verifying security headers.
What are HTTP headers?
HTTP headers are metadata sent in every HTTP/HTTPS request and response header. They provide key information about the resource, how it is processed, security policy and caching. The server sends headers along with the response content - the client (browser) interprets them and stores them appropriately.
Most important headers to check
Content-Type- MIME type of the resource (text/html, application/json, image/webp). Important for correct processing by the browser.Cache-Control- caching policy: no-cache, no-store, max-age=3600. Critical to performance and safety.Content-Security-Policy (CSP)- Restricts the sources of scripts, styles, and other resources. Protects against XSS.Strict-Transport-Security (HSTS)- Enforces HTTPS.X-Frame-Options- protects against clickjacking.X-Content-Type-Options: nosniff- prevents MIME sniffing.Access-Control-Allow-Origin- CORS policy for API.Server- server identification (may reveal version - security information).
How to parse security headers?
A good HTTP security configuration should include: Content-Security-Policy (blocks XSS), Strict-Transport-Security (forces HTTPS for a minimum of one year), X-Content-Type-Options: nosniff, X-Frame-Options: SAMEORIGIN or DENY, Referrer-Policy: strict-origin-when-cross-origin, Permissions-Policy (access control to camera, microphone). Tools like securityheaders.com automatically grade (A+–F) security header configurations.
Diagnosing cache problems
The Cache-Control and ETag headers are crucial in diagnosing caching problems:Cache-Control: no-cache- the browser must validate with the server before using the cache.Cache-Control: max-age=31536000, immutable- resource cached for a year, does not change (ideal for static assets with a hash in the name).ETag: "abc123"- resource fingerprint for conditional requests (If-None-Match). Compare headers between dev and prod environments to detect differences in caching configuration.
FAQ
How to check HTTP headers in terminal?
Use curl:curl -I https://example.com(HEAD request headers only). Or:curl -v https://example.com(full verbose with request and response headers). In Chrome DevTools: Network → click request → Headers tab. In Firefox: Developer Tools → Network → click request → Headers.
What does the X-Powered-By header mean and should I remove it?
X-Powered-By: PHP/8.2.0 or X-Powered-By: Express reveals backend technology and version - useful information for attackers looking for known vulnerabilities. It is recommended to hide or remove this header: in PHP:header_remove('X-Powered-By')orexpose_php = Offin php.ini. In Express.js:app.disable('x-powered-by').
How to set CORS headers for API?
For public APIs:Access-Control-Allow-Origin: *. For specific domains:Access-Control-Allow-Origin: https://twoja-domena.pl. For preflight (OPTIONS):Access-Control-Allow-Methods: GET, POST, PUT, DELETE i Access-Control-Allow-Headers: Content-Type, Authorization. Incorrect CORS is a common cause of "blocked by CORS policy" errors in the browser console.
What is an ETag header and how does a conditional request work?
ETag is the "fingerprint" of the resource's version (hash or timestamp). The browser caches the resource with the ETag. On repeat request it sends:If-None-Match: "etag-value". The server compares - if the resource has not changed, it returns 304 Not Modified with no content (saving bandwidth). If changed - 200 OK with new content and new ETag.
How do I add a Strict-Transport-Security (HSTS) header?
In Nginx:add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload";. In Apache:Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains". Make sure HTTPS is working properly before enabling HSTS - misconfiguration can block access to the site for a year. The preload option adds the domain to the browsers' preloaded HSTS lists.