HTTP Headers Checker
See status, redirect target, and response headers from a live GET request. Useful for cache, HSTS, CSP, and CDN hints.
FAQ
Why server-side fetch?
Browsers hide cross-origin response headers from JavaScript—our API performs the GET so you see `cache-control`, `server`, `via`, HSTS, etc., for debugging CDN and origin stacks.
SSRF protections?
We block obvious private-network targets; attackers still shouldn’t probe internal IPs through any public tool—responsible disclosure matters.
HEAD vs GET?
We issue GET to match real page fetches; some origins differ on HEAD—note discrepancies when diagnosing.
Auth flows?
Endpoints requiring cookies or Bearer tokens cannot be fully diagnosed without you supplying secrets—avoid pasting production tokens into shared chats.
Redirect loops?
Fetch follows redirects until completion—inspect final URL vs hop headers when staging migrations.
Rate limits?
Aggressive automated checking may trip WAF rules—space out requests.
Explore More Tools
Tap a tag to open a tool. The current page is highlighted.
