HTTP Headers Checker

HTTP response headers are metadata sent by a server with every response — before the actual page content. They tell the browser how to handle the response: what content type it is, how long to cache it, whether to allow cross-origin requests, what security policies to enforce, and how redirects should work. Checking response headers is essential for debugging caching issues, redirect chains, CORS problems, and security misconfigurations.

Essential: Content-Type (with charset), Strict-Transport-Security (HSTS, forces HTTPS), X-Content-Type-Options: nosniff (prevents MIME sniffing), X-Frame-Options (prevents clickjacking), Content-Security-Policy (controls resource loading). Useful: Cache-Control (caching rules), Referrer-Policy (controls referrer leakage), Permissions-Policy (restricts browser APIs). See our Security Headers Checker for a dedicated security-header audit.

This tool follows redirects and shows the final response headers. Use our Redirect Checker to see every hop in the redirect chain, including the headers returned at each step. This is useful for diagnosing redirect loops, checking that HSTS is set on the final destination, or verifying that a CDN is serving the correct cache headers.

no-store means the browser must not save any part of the response — not in memory, not on disk. Used for sensitive pages (banking, health). no-cache means the browser can cache the response but must revalidate with the server before using it (sends a conditional request). max-age=0, must-revalidate has the same effect as no-cache. For static assets (images, CSS, JS) you want long max-age with cache-busting file names instead.