HTTP Headers Checker
Check HTTP response headers for any URL.
Fetching headers...
Response Headers
Note: Due to browser CORS restrictions, this tool may not work for all URLs. For complete header analysis, use command-line tools like curl.
Understanding HTTP Headers
What Are HTTP Headers?
HTTP headers are metadata sent between clients (browsers, applications) and servers during HTTP communication. They appear at the beginning of HTTP requests and responses, before the actual content (body). Headers provide crucial information about the request, response, or the data being transferred.
Headers are formatted as key-value pairs:
Content-Type: text/html; charset=UTF-8
Cache-Control: max-age=3600
X-Frame-Options: DENY
Headers influence caching behavior, security policies, content negotiation, authentication, and how browsers render pages.
Request Headers vs. Response Headers
Request Headers
Sent by the client to the server. Provide information about the client and the requested resource.
- User-Agent (browser identity)
- Accept (content types client can handle)
- Cookie (session data)
- Authorization (credentials)
- Referer (previous page URL)
Response Headers
Sent by the server back to the client. Describe the response and instruct the browser.
- Content-Type (response format)
- Set-Cookie (create cookies)
- Cache-Control (caching rules)
- Location (redirect URL)
- Security headers (CSP, HSTS)
Common HTTP Headers Explained
User-Agent
Identifies the client software (browser, bot, application). Servers use this for content negotiation, analytics, and bot detection. Can be spoofed by clients.
Content-Type
Specifies the MIME type of the content. Examples: text/html, application/json, image/png. Essential for browsers to correctly interpret and render content.
X-Forwarded-For
Used by proxies and load balancers to pass the original client IP address. Can contain multiple IPs if the request passed through multiple proxies. Often checked by servers for rate limiting and geolocation.
Cache-Control
Directives for caching mechanisms. Values like max-age=3600 (cache for 1 hour), no-cache (validate before using), no-store (never cache). Critical for performance and freshness.
Authorization
Contains credentials for authenticating with the server. Common schemes: Basic (base64-encoded username:password), Bearer (OAuth tokens). Sensitive - should only be sent over HTTPS.
Set-Cookie / Cookie
Set-Cookie (response) creates cookies on the client. Cookie (request) sends stored cookies back to the server. Used for session management, preferences, and tracking.
Security Headers
Response headers that improve website security:
Content-Security-Policy (CSP)
Controls which resources (scripts, styles, images) can be loaded and from where. Helps prevent XSS attacks by restricting inline scripts and untrusted sources.
Strict-Transport-Security (HSTS)
Tells browsers to only connect via HTTPS for a specified duration. Prevents downgrade attacks and cookie hijacking over insecure connections.
X-Frame-Options
Controls whether the page can be embedded in frames/iframes. Values: DENY (never), SAMEORIGIN (only same domain). Prevents clickjacking attacks.
X-Content-Type-Options
When set to "nosniff", prevents browsers from MIME-sniffing (guessing content type). Ensures content is treated as declared Content-Type.
Headers in Security and Bot Detection
Servers analyze HTTP headers to detect bots and suspicious activity:
- Missing standard headers: Real browsers send many headers (Accept-Language, Accept-Encoding). Simple bots often omit these.
- Header order: Different browsers send headers in characteristic orders. Anomalies can indicate non-browser clients.
- Impossible combinations: Conflicting headers (e.g., mobile User-Agent with desktop screen hints) reveal spoofing.
- Proxy detection headers: X-Forwarded-For, Via, and similar headers reveal proxy usage when not properly configured.
- TLS fingerprinting: While not HTTP headers, the TLS handshake characteristics are often analyzed alongside headers.
Frequently Asked Questions
What is the difference between HTTP headers and HTML meta tags?
HTTP headers are sent at the protocol level, before any HTML content, and are processed by both browsers and intermediate systems (caches, proxies, CDNs). HTML meta tags are embedded within the HTML document and only affect browser behavior after the document is parsed. Some directives can be set both ways (like cache-control or CSP), with HTTP headers generally taking precedence.
Why are some headers prefixed with X-?
The "X-" prefix historically indicated non-standard, experimental, or custom headers. Examples include X-Frame-Options, X-XSS-Protection, and X-Forwarded-For. While this convention is now deprecated (RFC 6648), many X-prefixed headers remain widely used. New custom headers should use meaningful names without the X- prefix.
What does CORS have to do with headers?
Cross-Origin Resource Sharing (CORS) is controlled entirely through HTTP headers. Key headers include Access-Control-Allow-Origin (which domains can access resources), Access-Control-Allow-Methods (which HTTP methods are permitted), and Access-Control-Allow-Headers (which request headers are allowed). CORS restrictions are why this browser-based tool cannot fetch headers from all URLs.
How can I see all HTTP headers, including those blocked by CORS?
Browser-based tools are limited by CORS. For complete header visibility, use: command-line tools like curl (curl -I https://example.com), browser developer tools (Network tab shows all headers for your own requests), server-side scripts that make requests and return headers, or dedicated API services that act as intermediaries.
What security headers should every website have?
Essential security headers include: Strict-Transport-Security (HSTS) for HTTPS enforcement, Content-Security-Policy (CSP) to prevent XSS, X-Content-Type-Options: nosniff, X-Frame-Options to prevent clickjacking, and Referrer-Policy to control referrer information. The specific values depend on your site's requirements.
How do caching headers affect website performance?
Caching headers dramatically impact performance. Cache-Control and Expires headers tell browsers and CDNs how long to store resources. ETag and Last-Modified enable conditional requests (304 Not Modified responses). Proper caching reduces server load, decreases latency for users, and lowers bandwidth costs. Incorrect caching can cause users to see stale content.
Need to Test from Different Locations?
Use VeProxy's residential proxies to check headers from any country.
Get Started Now