Inspect the response status, timing and header fields from the existing HEAD request. Repeated fields retain order and value case.
Method, limits and data
Field names are case-insensitive; values are not universally so. The seven-name presence indicator is bounded at 100 and does not evaluate policy strength or certify security. Examples and reference text are illustrative, not current measurements or guarantees of availability, precision or logging practices.
The URL is sent to this site. Ten URLs are kept in local history and can be cleared. Copy includes the full report even while the displayed list is filtered.
How to use
- Enter the URL and inspect the response.
- Filter field names or exact-case values; copy the full report and clear history if needed.
Two Set-Cookie fields remain separate. Filtering AUDIT matches X-Audit; a value AbC is not changed to abc.
Does a score of 100 mean the site is secure?
No. It only indicates the presence of seven header names. Repeated names count once and their actual values still need review.
Invalid or empty input clears the previous answer. A timeout or refusal is a failed observation, not a zero measurement or proof of absence. Changing input discards late answers; retry only when ready.
Reference texts, snapshot 27 October 2026; not a live service check.
HTTP Headers Checker
Inspect the response status, timing and header fields from the existing HEAD request. Repeated fields retain order and value case. Inspect the fields actually returned for this request. Counts, values and the seven-name presence percentage can vary. Presence does not validate policy values or certify security, and no example domain has a guaranteed current count or percentage.
Header presence indicator; not a security certificate.
Response Headers
Recent
Copied
Copy failed. Select the result and copy it manually.
Popular Tools
About HTTP Headers Checker
Inspect the response status, timing and header fields from the existing HEAD request. Repeated fields retain order and value case.
Inspect the fields actually returned for this request. Counts, values and the seven-name presence percentage can vary. Presence does not validate policy values or certify security, and no example domain has a guaranteed current count or percentage.
Field names are case-insensitive; values are not universally so. The seven-name presence indicator is bounded at 100 and does not evaluate policy strength or certify security.
The URL is sent to this site. Ten URLs are kept in local history and can be cleared. Copy includes the full report even while the displayed list is filtered.
Two Set-Cookie fields remain separate. Filtering AUDIT matches X-Audit; a value AbC is not changed to abc.
Use Cases
How to use
Enter the URL and inspect the response.
Filter field names or exact-case values; copy the full report and clear history if needed.
Inspect the fields actually returned for this request. Counts, values and the seven-name presence percentage can vary. Presence does not validate policy values or certify security, and no example domain has a guaranteed current count or percentage.
Scan the Response Headers list, narrowing it with the Filter headers box if the response is long.
Press Copy to take the whole header set as text; Recent keeps your last ten addresses, and Clear empties that list.
Pro Tips
- Inspect the fields actually returned for this request. Counts, values and the seven-name presence percentage can vary. Presence does not validate policy values or certify security, and no example domain has a guaranteed current count or percentage.
- The eight site chips fire the check on click, so they are the fastest way to get a reference response to compare your own site against.
- A high score is not a full audit: it counts seven header names and nothing about their values, so a Content-Security-Policy of unsafe-inline still scores as present.
- Servers speaking HTTP/2 send field names in lower case, so the list shows strict-transport-security rather than Strict-Transport-Security — the audit matches case-insensitively, so the tick still appears.
- Recent holds the last ten addresses in your own browser storage rather than on the server; Clear wipes it, and a private window starts empty.
Troubleshooting
The check answers "Private/reserved IP addresses are not allowed".
That is deliberate. The request is made from this site's server, so allowing private addresses would let the page probe internal networks on someone's behalf. Anything on 127.x, 10.x, 172.16-31.x or 192.168.x is refused. To read the headers of a device on your own LAN, use your browser's DevTools Network tab instead.
The check answers "Connection failed: Could not resolve host".
The hostname did not resolve: check the spelling, and check that you typed a domain rather than a search phrase. If the domain is new, DNS may not have propagated yet. The same message appears for a domain that has expired or has no A record.
The presence indicator differs from an earlier example.
Inspect the fields actually returned for this request. Counts, values and the seven-name presence percentage can vary. Presence does not validate policy values or certify security, and no example domain has a guaranteed current count or percentage.
The headers here do not match what Chrome DevTools shows me.
Two different requests. This page asks from a clean server-side client with no cookies, no extensions and a different user agent, while DevTools shows your own session. A response that varies by Accept-Language, Accept-Encoding or a signed-in cookie will legitimately differ; check the vary header in the list.
The Response Headers list goes empty while I type in the filter.
Filter headers matches your text against both the field name and its value, in lower case, and hides everything else. A term such as "security" leaves only the policy headers, and a typo leaves nothing. Clear the box to bring the full list back.
Frequently Asked Questions
Headers are name/value fields describing one response. This page displays the fields returned to this server, including repeated names; the count is not fixed for any domain.
Enter a public HTTP(S) URL and run the check. The server makes one HEAD request and shows its status, returned fields and a qualified presence indicator; it does not perform a full security audit.
Inspect the fields actually returned for this request. Counts, values and the seven-name presence percentage can vary. Presence does not validate policy values or certify security, and no example domain has a guaranteed current count or percentage.
Open DevTools with F12, go to the Network tab, reload the page, click the top request and read the Response Headers panel. That shows the headers as your own browser received them, cookies and extensions included; this tool asks from a clean server-side client instead, which is why the two lists can differ.
The seven this page audits: Strict-Transport-Security forces HTTPS, Content-Security-Policy restricts what may load, X-Content-Type-Options stops MIME sniffing, X-Frame-Options blocks framing, X-XSS-Protection is a legacy filter, Referrer-Policy controls what is sent in the Referer field, and Permissions-Policy limits browser features such as camera access.
Read the returned values alongside the seven-name presence indicator. It counts names, not the correctness of their values. No domain is promised a particular percentage.
Because the body of a response says nothing about itself. Headers tell the browser what the content is, whether it may be cached, whether it must be fetched over HTTPS next time, which origins may run scripts on the page and whether the response may be shown inside a frame. Remove them and the browser has to guess.
Fields are displayed as names and values. Names are case-insensitive while value case and repeated fields can matter; the response, protocol and intermediaries affect the actual fields.
Response headers can expose operational details. Inspect the actual returned fields; this page cannot guarantee a specific CDN, configuration or privacy outcome from an example domain.
There is no fixed header count. The count depends on the response, method, protocol and intermediaries; earlier examples are not current measurements.
No. It only indicates the presence of seven header names. Repeated names count once and their actual values still need review.