HTTP Header Checker
Enter a URL to fetch its response headers, or paste headers you already have — then analyze them for security, caching, and CORS configuration
Raw Headers
Paste HTTP headers and click Analyze
Security Headers, CORS, and Cache Checks
Enter a URL and the checker fetches its response headers for you, or paste headers you already captured from curl or the browser devtools. Either way you get the same analysis: security, CORS, caching, redirects, cookies, content type, and CDN behavior. The analyzer highlights important headers like Content-Security-Policy, Strict-Transport-Security, X-Frame-Options, Cache-Control, ETag, and Access-Control-Allow-Origin, and explains what each one is doing.
Key Features
- Enter a URL to fetch its live response headers, or paste headers you already have
- Security header checks for CSP, HSTS, X-Frame-Options, X-Content-Type-Options, and Referrer-Policy
- CORS header analysis for cross-origin API debugging
- Cache header review for Cache-Control, ETag, Last-Modified, Expires, and Vary
- Cookie flags review for Secure, HttpOnly, and SameSite settings
- Readable explanations that help turn raw headers into clear next steps
- Free online checker with no sign-up required
Common Use Cases
- Auditing a production site before launch
- Debugging CORS errors between a frontend and API
- Checking whether CDN and browser caching are configured correctly
- Reviewing security hardening after a deployment
- Comparing headers across staging and production domains
- Finding redirect, content type, compression, and cookie configuration issues
Frequently Asked Questions
How do I check HTTP headers online?
Enter a URL and the checker fetches the response headers for you, then groups them by security, CORS, caching, cookies, and general metadata. If you already have the headers — from curl -I or the browser devtools — you can paste them instead and get the same analysis.
Which security headers should a website have?
Most sites should consider Content-Security-Policy, Strict-Transport-Security, X-Frame-Options or frame-ancestors, X-Content-Type-Options, Referrer-Policy, and a restrictive Permissions-Policy.
Can this help debug CORS errors?
Yes. The analyzer shows Access-Control-Allow-Origin, Access-Control-Allow-Methods, Access-Control-Allow-Headers, Access-Control-Allow-Credentials, and related preflight behavior so you can spot mismatches quickly.
Why do cache headers matter?
Cache-Control, ETag, Last-Modified, Expires, and Vary decide how browsers and CDNs reuse responses. Good cache headers can improve speed, while incorrect headers can serve stale content or bypass useful caching.