HTTP headers
Read the headers returned by a URL. Review caching, security headers, and the redirect path.
Quick start
- Enter a URL.
- Inspect the final response and redirects.
- Compare cache and security headers with your settings.
How the request works
The server sends a HEAD request. If the server responds with 405 or 501, it can fall back to GET while avoiding a response-body download. Up to 3 HTTP redirects are followed.
Only standard HTTP port 80 and HTTPS port 443 are supported. The tool does not supply your browser’s cookies, login session, or JavaScript environment.
Useful headers
| Header | What it tells you |
|---|---|
| Content-Type | The declared media type |
| Cache-Control | Caching directives |
| Location | A redirect destination |
| Strict-Transport-Security | HTTPS enforcement policy |
| Content-Security-Policy | A policy controlling browser resource use |
| X-Content-Type-Options | Controls MIME sniffing behavior |
Security headers in context
A header’s presence is only one part of security. A CSP can be too permissive, and HSTS should match the deployment’s HTTPS coverage.
Server headers can be absent or misleading. A product name alone does not establish the real version or vulnerability status.
Why a browser gets a different response
Location, cookies, authentication, cache, request method, and WAF rules can change the response. Compare the exact URL and final destination before drawing conclusions.
Viewing response headers with curl
You can send the same HEAD request as this tool with curl -I. The output below keeps only the security-related headers of PPORT’s home page.
$ curl -sI https://pport.cloud/ko/ | grep -iE '^(HTTP|strict-transport|x-content-type|x-frame|referrer-policy|permissions-policy)'
HTTP/1.1 200 OK
X-Content-Type-Options: nosniff
X-Frame-Options: DENY
Referrer-Policy: same-origin
Permissions-Policy: camera=(), microphone=(), geolocation=()
Strict-Transport-Security: max-age=31536000Content-Security-Policy is left out because it carries a nonce that changes on every request. Add -L to the same command to print the headers of each redirect step in turn.
A common mistake when adding security headers in nginx
server {
add_header Strict-Transport-Security "max-age=31536000" always;
add_header X-Content-Type-Options "nosniff" always;
location /static/ {
add_header Cache-Control "public, max-age=604800";
}
}add_header values are inherited from the outer block only when the current block has no add_header of its own. In the example, the /static/ block sends only Cache-Control and loses HSTS and nosniff. If you use add_header in a nested block, repeat the security headers there too.
Without always at the end, nginx adds the header only to 200, 201, 204, 206, 301, 302, 303, 304, 307 and 308 responses. Add always to apply the same policy to error responses such as 404 or 500.