Caching
Freshness, validation and cache behavior.
Free HTTP Headers Checker
Enter any public URL to inspect the HTTP response headers observed by our scanner. Search the complete values, group common headers by purpose, and open a neutral result with no account required.
What are HTTP response headers?
HTTP response headers are metadata sent by a server or intermediary with an HTTP response. They describe how clients should cache, interpret, authenticate, share and process the returned content.
They are separate from the response body. A single page can return content details, cookies, cross-origin rules, timing data and security instructions through its headers before the browser renders the body.
Understand the headers you find
Open the complete HTTP Header Reference, or start with a commonly observed field.
Cache-ControlDefines directives that govern how browsers and intermediary caches store and reuse a response.Content-TypeDeclares the media type and optional character encoding of the response representation.Set-CookieInstructs a client to store a cookie with attributes that define its scope and lifetime.Content-Security-PolicyDefines the sources from which a document may load and execute different kinds of resources.Server-TimingCommunicates named timing metrics collected while a server processed the request.Access-Control-Allow-OriginIdentifies the origin allowed to access the response from a cross-origin browser request.
How to check HTTP headers
- Step 1
Enter a public URL
Provide the HTTPS or HTTP address whose response you want to inspect.
- Step 2
Make one server-side request
Submit the URL once. The scanner follows redirects and records the final successful response returned to its Cloudflare Worker.
- Step 3
Inspect the stored result
Search names and complete values, then browse headers grouped by their common purpose.
Response header categories
The result groups familiar fields by purpose while keeping every observed value available for inspection.
Content representation
Media type, encoding, language and negotiation.
CORS
Cross-origin access and exposed response fields.
Cookies and authentication
Session cookies and authentication challenges.
Redirects
Target locations and response navigation.
Linking and performance
Related resources, hints and server timings.
Security and privacy
Browser protections and information policies.
Infrastructure
Server, proxy, CDN and request-tracing details.
Example HTTP response headers
A response starts with a status line, followed by named fields and their values. The exact set varies by website, route and request.
HTTP/1.1 200 OK
Content-Type: text/html; charset=utf-8
Cache-Control: public, max-age=300
Content-Encoding: br
Vary: Accept-Encoding
Server-Timing: edge;dur=23What this checker can and cannot show
The response the scanner observed
The checker follows redirects and shows the final successful response. Values reflect what the Cloudflare Worker observed, so they are not a guaranteed direct response from the origin server. A CDN, proxy or other intermediary may add, remove or change fields.
Known scanner-transport headers are excluded from the result. Custom and less common fields can still appear under Other even when the checker does not yet publish an explanation for them.
A neutral inventory, not a verdict
This neutral view is not a vulnerability assessment. It shows the response metadata the scanner can observe without grading the result or claiming that the website is secure.
The homepage Security Headers Checker provides security analysis for supported browser-facing protections. Neither view replaces broader application testing or a penetration test.
HTTP headers checker FAQ
Is the HTTP headers checker free?
Yes. You can scan a public URL and inspect its result for free, without creating an account.
Does the checker change response headers?
The checker does not edit the website’s response. It reports what the Cloudflare Worker receives after redirects, with known scanner-transport fields filtered from the display.
Are cookies shown?
Yes. Visible Set-Cookie response values are shown unmasked as captured by the scanner. Review results carefully before sharing them.
Why can browser DevTools show different headers?
Your browser and the Worker can take different network paths, send different request headers or receive personalized and cached responses. Browser extensions, service workers, CDNs and timing can also make DevTools differ from this server-side observation.
Are custom headers supported?
Yes. Custom or unrecognized response fields remain visible under Other even when no published explanation is available.