HTTP Response Headers Checker
Fetch any public URL and view its HTTP status and response headers, with checks for HSTS, CSP, X-Frame-Options, nosniff and other security headers.
https:// is added when no scheme is given.
What is HTTP Headers Checker?
This tool requests a URL and shows the status line and every response header the server sends back, like curl -I but in the browser. It follows redirects and then evaluates the final response for common security headers: HSTS, Content-Security-Policy, X-Content-Type-Options, framing protection, Referrer-Policy, Permissions-Policy and X-Powered-By.
How to use HTTP Headers Checker
- Enter a public URL; https:// is added if you leave out the scheme.
- Press Check.
- Read the final status code, the number of redirects followed and the full header list.
- Review the security header checklist below the table and copy the raw headers if needed.
When to use HTTP Headers Checker
Use it to verify caching, compression, CORS or security headers after a deployment, or to see what a CDN adds. The request comes from a Cloudflare data center with a generic user agent, so geo-targeted, bot-protected or logged-in responses can differ from what you see; for private intranet URLs use curl on your own machine.
How HTTP Headers Checker works
Browsers are not allowed to read another site's headers, so the request is made by AlgoKit's Cloudflare Pages Function (/api/fetch-meta). It validates the URL (http/https only, no credentials), resolves the host over DNS-over-HTTPS and refuses private, loopback, link-local, CGNAT and cloud-metadata addresses, then sends a GET request without cookies, following up to 10 redirects manually with an 8-second total timeout. Only status codes, headers and a few extracted HTML fields are returned; cookie values in Set-Cookie are redacted. The security checks run in your browser on the returned headers.
Common Use Cases
- Confirm that Strict-Transport-Security and Content-Security-Policy are set in production.
- Check Cache-Control and ETag headers on a static asset.
- See which server, CDN or framework a site reports.
- Verify that a redirect ends on the right URL before looking at headers.
Security Note
The URL you enter is fetched by AlgoKit's server. Do not check URLs that contain secrets or one-time tokens in the query string.
FAQs
Why can't my browser read these headers itself?
The same-origin policy only exposes a few CORS-safelisted headers of cross-origin responses to JavaScript, and only if the server allows it. A server-side request sees all headers.
Is the page content stored?
No. The function reads at most 512 KB of HTML only to extract metadata used by related tools, and nothing is logged or kept.
Why is my internal URL refused?
To prevent server-side request forgery, private and local addresses (10.x, 192.168.x, localhost, *.local, metadata IPs) are blocked, including names that resolve to them.