HTTP Headers Parser
Request a URL and view its HTTP status and response headers.
Looks up live data What you enter is sent to our server to fetch live results from public sources. Results are cached briefly. A Cloudflare Turnstile bot check runs when you press the button (it loads a script from challenges.cloudflare.com and may show a short challenge).
A Cloudflare Turnstile bot check runs when you press the button (it loads a script from challenges.cloudflare.com and may show a short challenge).
Report a problem with this tool
About this tool
Enter a web address and the tool requests it, follows up to 3 redirects, and lists the final URL, the status code and every response header as name and value pairs. Use it to check caching, content type, security headers, server software or redirect targets. The request is made by our server, so the address you enter is sent to us, and the headers can differ from what your own browser sees (cookies, location, language or user agent can change a response). Internal addresses and unusual ports are refused. A result may be reused for up to a minute, so wait a minute before checking a change again.
How to use it
- Enter the page address.
- Press Parse headers.
- Read the final URL and status.
- Look through the header table for the one you need.
Headers worth checking
- content-type
- What the response is, such as text/html; charset=utf-8. A wrong type can make browsers show a page as plain text or refuse a script.
- cache-control, expires, etag, last-modified
- How long browsers and CDNs may keep a copy, and how they check whether it has changed.
- age, cf-cache-status, x-cache
- Set by caches and CDNs. They show whether the response came from a cache and how old it is.
- location
- Where a redirect points. Here you see the final response, so use the Redirect Checker for each hop.
- server, x-powered-by
- The software that answered. Many sites remove or shorten these so they reveal less.
- x-robots-tag
- Can tell search engines not to index a page or file, just like a robots meta tag.
- strict-transport-security, content-security-policy
- Security headers. The Security Headers Auditor checks whether their values actually protect.
Check headers yourself
In a browser, open developer tools (F12), go to the Network tab, reload and click the first request. From a terminal, curl shows the same information. The first command sends a HEAD request, which some servers answer differently. The second sends a normal GET, follows redirects and prints the headers of every response.
curl -I https://example.com/ curl -sSL -D - -o /dev/null https://example.com/
Common problems
- The headers differ from what my browser shows
- The request comes from our server with its own user agent and location, so personalized or geo-based responses can differ.
- The status is not the one I expected
- Redirects are followed, so the status and headers belong to the last response, not the first.
- The request fails
- Check that the site is reachable and uses a standard port; private addresses are refused.
Frequently asked questions
Why are all header names lowercase?
Header names are case-insensitive, so Content-Type and content-type are the same header. HTTP/2 and HTTP/3 always send them in lowercase, and this tool lists them that way.
How do I check a site's security headers?
They appear in this list if they are sent. To see which are missing or set to weak values, use the Security Headers Auditor.