# HTTP Header Viewer - Free Online Header & Security Analyzer

View HTTP response headers exposed to your browser when the target allows cross-origin access. A missing visible header may still be present on the server; this is not a security audit.

Investigating a domain? Use [DNS Record Lookup](https://www.toolcomb.com/dns-record-lookup) for records from a public resolver, or read the limitations of the [browser HTTPS request](https://www.toolcomb.com/ssl-certificate-checker). Each tool makes its own network request.

### HTTP Header Analyzer

Sends the entered URL as a HEAD request from your browser to that site. Many sites block it or expose only a subset of response headers.

CORS and browser policies restrict what this page can read. A header not shown here is not proof it is missing, and the percentage is only visible-header coverage-not a site security rating.

_Enter URL (e.g., https://example.com)_  Analyze

7 Security Headers Checked

CSP, HSTS, X-Frame-Options, and more

Response Time & Status

See exactly how the server responded

Auto-Categorized

Security, content, cache, and server headers

Exportable Report

Download the full analysis as a text file

### What Are HTTP Headers?

**HTTP headers** are key-value pairs sent between browsers and servers as part of every web request and response. They carry metadata that never appears on the page itself but controls how the browser handles the response - what caching policy to apply, what security restrictions to enforce, what content type to expect, and which server or CDN generated the response.

Response headers fall into a few broad categories: **security headers** (like Content-Security-Policy and Strict-Transport-Security) that instruct the browser on what to trust and how to protect the user; **content headers** (like Content-Type and Content-Encoding) that describe the payload; **caching headers** (like Cache-Control and ETag) that control how long and how a response can be reused; and **server headers** that reveal information about the backend infrastructure serving the request.

This tool attempts a browser request and categorizes the headers made visible to it. It can help inspect an allowed response, but browser restrictions may block the request or hide headers. Use browser developer tools or a dedicated server-side checker for a complete inspection.

### How to Use the HTTP Header Viewer

1. 1

1. Enter a URL

Type or paste any public website URL. If you omit the protocol, https:// is added automatically.
2. 2

2. Click Analyze

The browser sends a HEAD request. If allowed, the page displays its status, time, visible headers and selected-header coverage.
3. 3

3. Browse by Category

Headers are automatically sorted into Security, Content, Cache, Server, and Other tabs, so you can jump straight to the category you care about instead of scanning a raw list.
4. 4

4. Search for a Specific Header

Use the search box to filter by header name or value - useful for quickly checking whether a specific directive like max-age or nosniff is present.
5. 5

5. Review the Security Checklist

The checklist counts seven selected headers visible to this browser. A header not exposed to the page is not necessarily missing from the server response.
6. 6

6. Copy or Export

Copy a visible value or export the browser-visible results as a text file. The export is not a complete server response or a security audit.

### The 7 Security Headers This Tool Checks

#### Content-Security-Policy (CSP)

Restricts which sources scripts, styles, images, and other resources can be loaded from, making it one of the strongest defenses against XSS and data-injection attacks.

#### Strict-Transport-Security (HSTS)

Tells browsers to only ever connect to the site over HTTPS for a specified duration, preventing protocol-downgrade and man-in-the-middle attacks on future visits.

#### X-Frame-Options

Controls whether the page can be embedded in an iframe on another site, protecting against clickjacking attacks. Modern sites increasingly use the CSP frame-ancestors directive for the same purpose.

#### X-Content-Type-Options

Set to nosniff, this stops browsers from trying to guess ("sniff") a resource's MIME type, preventing certain content-type confusion attacks.

#### Referrer-Policy

Controls how much URL information is sent in the Referer header when users navigate away from the page, limiting accidental leakage of sensitive query parameters or internal paths.

#### Permissions-Policy

Lets a site explicitly enable or disable browser features and APIs (camera, microphone, geolocation, and more), reducing the attack surface exposed to third-party scripts.

#### X-XSS-Protection

A legacy header that enabled a browser's built-in XSS filter. Modern browsers have largely removed this filter in favor of CSP, but the header is still checked for compatibility with older clients.

### Header Categories Explained

| Category | Example Headers | What It Controls |
| --- | --- | --- |
| Security | CSP, HSTS, X-Frame-Options, X-Content-Type-Options | Browser-enforced protections against XSS, clickjacking, and protocol downgrade attacks |
| Content | Content-Type, Content-Encoding, Accept-* | How the response body should be parsed, decoded, and rendered |
| Cache | Cache-Control, ETag, Expires, Last-Modified | Whether and how long browsers and CDNs can reuse a cached response |
| Server | Server, X-Powered-By, Via | What backend software, framework, or proxy generated the response |
| Other / Custom | X-Request-Id, X-RateLimit-*, app-specific headers | Application-specific metadata not covered by the standard categories |

### Common Use Cases for HTTP Header Analysis

#### Security Audits

Quickly check whether a production site has the OWASP-recommended security headers in place before a launch, penetration test, or compliance review.

#### Debugging Caching Issues

Inspect Cache-Control, ETag, and Expires values to understand why a resource isn't being cached - or is being cached longer - than expected.

#### CDN & Reverse Proxy Verification

Confirm that a CDN, load balancer, or reverse proxy is correctly forwarding or adding headers like Via, X-Cache, or custom routing headers.

#### SEO & Content-Type Checks

Verify Content-Type and charset declarations are correct, and confirm compression (Content-Encoding: gzip/br) is enabled for faster page loads.

#### Competitive Research

See what server stack, CDN, or security configuration a competitor or reference site is using, without needing access to their infrastructure.

#### API Response Debugging

Inspect rate-limit headers, CORS headers, and custom API metadata headers when integrating with or debugging a third-party API.

### How Visible Header Coverage Is Calculated

This page counts which of seven selected response headers are visible in the browser - Strict-Transport-Security, X-Frame-Options, X-Content-Type-Options, X-XSS-Protection, Content-Security-Policy, Referrer-Policy, and Permissions-Policy - and expresses the proportion visible as a percentage. A lower percentage does not prove the server omitted a header: browser policies can prevent scripts from reading it.

This is not a security rating or a full grading of each header's configuration quality - a site can have a Content-Security-Policy header present but still configured too loosely (for example, allowing 'unsafe-inline' scripts) to meaningfully block XSS. Treat a high result only as a partial view, and review each header's actual value for weak or overly permissive settings as a next step.

### Key Features

Security Analysis

Partial visibility of selected headers; not a complete security assessment

Categorized Headers

Organized by security, content, caching, and server headers

Search & Filter

Quick search through headers with real-time filtering

Export Data

Download header analysis results for documentation

### Frequently Asked Questions

#### Why can't I fetch headers for some websites?

Some sites block automated requests, sit behind authentication, or enforce strict CORS and bot-protection policies that prevent header retrieval. The tool works best on publicly accessible pages.

#### Does full visible-header coverage mean a site is secure?

No. The percentage counts seven headers visible to the browser; it does not assess their configuration or overall security. A header not shown may be hidden by browser policies.

#### What's the difference between X-Frame-Options and CSP frame-ancestors?

Both prevent a page from being embedded in another site's iframe. X-Frame-Options is the older, simpler header; the CSP frame-ancestors directive is the modern replacement with more flexible source-matching, and takes precedence in browsers that support it.

#### Why does the Server header sometimes say "Unknown"?

The server might omit the header, or the browser might not expose it to this page. Unknown does not distinguish those cases.

#### Can I use this to check my own site before launch?

Yes. Running your production URL through this tool before launch is a quick way to confirm caching headers, content types, and security headers are all configured as intended.

#### Does this tool store the URLs I analyze?

The tool fetches headers on demand to display results in your browser session. No history of analyzed URLs is shown to other visitors, and results reset when you start a new analysis or leave the page.

## Related Tools

Discover more free tools that might help with your next task.

[Reverse IP Lookup Resolve an IPv4 address to its reverse DNS PTR hostname Use Tool](https://www.toolcomb.com/reverse-ip-lookup)

[DNS Record Lookup Look up DNS records for domains Use Tool](https://www.toolcomb.com/dns-record-lookup)

[Lighthouse Score Simulator Estimate a Lighthouse-style performance score from page metrics Use Tool](https://www.toolcomb.com/lighthouse-simulator)

[Domain to IP Convert domain names to IP addresses Use Tool](https://www.toolcomb.com/domain-to-ip)

[Ping Test Test network connectivity and latency Use Tool](https://www.toolcomb.com/ping-test)

[SSL Certificate Checker Check SSL certificate details and validity Use Tool](https://www.toolcomb.com/ssl-certificate-checker)

### Related guides

Read the how-to, then come back to this tool when you are ready to run it locally.

- [Why Chrome Says “Not Secure” (and What to Check First) HTTP pages, mixed content, name-mismatch certificates, and expired TLS. How to tell a padlock problem from a DNS problem without scanning hosts you do not own.](https://www.toolcomb.com/blog/why-chrome-says-not-secure)
- [How to Check Security Headers on a Live Site CSP, HSTS, X-Frame-Options, cookies, and noindex - what to look for in HTTP headers, how a header viewer helps, and what it will never prove.](https://www.toolcomb.com/blog/how-to-check-security-headers-on-a-live-site)
- [Why Your DNS Change Isn’t Showing Yet You updated A or CNAME records but the site still hits the old server. TTL, cache, recursive resolvers, and how to look up public DNS without confusing it with your laptop’s cache.](https://www.toolcomb.com/blog/why-dns-changes-are-not-showing)

[View All Tools](https://www.toolcomb.com/tools)