HTTP Header Inspector Online
Inspect HTTP response headers for any URL: security headers, cache-control, content-type, and more.
When an HTTP header inspector is the right tool
You often want a quick look at cache or security headers on a public URL. This page is for that from the browser: paste a URL, click Fetch (or press Enter), and read a table of header names and values, with optional Security and Cache filters. A scheme-less input is prefixed with https://.
The URL does leave your device. The first attempt is a direct CORS HEAD from this browser; if that does not work, the URL is sent to api.allorigins.win. Neither path is a complete substitute for inspecting headers on the server or with a local curl.
Use cases
Checking whether a few security headers are visible
The Security filter highlights a fixed list of names such as Content-Security-Policy and Strict-Transport-Security, when they were actually exposed to this page. A missing name may mean the site does not send it, or only that CORS or the proxy path hid it.
Reading cache-related fields
The Cache filter limits the table to Cache-Control, ETag, Last-Modified, Expires, Age, and Vary, again only if those headers were returned to the script. Copy still includes every collected header, not just the filtered view.
A first look at a public URL
This is handy when you cannot run curl locally. Treat unexpected or missing headers with caution, and confirm important values with a tool that is not limited by CORS or a proxy. For DNS or logged certificates, use DNS Lookup or the SSL Certificate Checker instead.
How the fetch works
After the optional https:// prefix, the page tries fetch(url, { method: 'HEAD', mode: 'cors' })and lists every header the browser exposes. On failure, it requests https://api.allorigins.win/get?url=…. If the wrapped HTTP status is 400 or higher, that path errors without a table. Surviving headers are sorted by name. While a request is in flight, the previous result is cleared. Success does not display the HTTP status code.
What this tool does not do
It does not guarantee a full header set, show a redirect chain, let you choose GET versus HEAD, or send custom request headers. It does not keep a history. To construct a request snippet, try the HTTP Request Builder.
How to use HTTP Header Inspector
- Paste a URL (a host alone is requested as
https://…). - Click Fetch or press Enter. The request goes to the site, and if needed to api.allorigins.win.
- Use All, Security, or Cache to filter the table, and Copy for the full list as text.
Frequently asked questions
How are the headers fetched, and does the request leave my device?
Yes. The page first tries a CORS HEAD request from your browser directly to the URL (https:// is added if you omit a scheme). If that fails or returns no headers, it falls back to https://api.allorigins.win/get?url=…, which fetches the URL on a third-party proxy. In both cases the target URL — and, for the proxy path, the URL itself — is sent off this device. Your address is also visible to the site you contact directly, or to the proxy.
Am I seeing the complete headers from the target site?
Not necessarily. A direct CORS request only exposes the headers the browser is allowed to reveal (CORS-safelisted names, plus any listed in Access-Control-Expose-Headers). The allorigins fallback reads headers from the proxy’s own HTTP response, not a guaranteed copy of the target’s headers, and it drops names that start with access-control as well as content-type. Do not treat either path as a full server-side capture such as curl -I.
What do the All, Security, and Cache filters do?
They only change which rows are displayed. Security matches Strict-Transport-Security, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, and X-XSS-Protection (compared case-insensitively). Cache matches Cache-Control, ETag, Last-Modified, Expires, Age, and Vary. Copy always copies the full unfiltered list as “Name: value” lines, not just the visible filter.
What errors might I see?
The direct path does not treat an HTTP error status as a failure by itself; it fails when the request throws or when no headers are exposed. The proxy path reports “Proxy returned” and the status if allorigins itself is not OK, and “Target returned HTTP N” when the wrapped status is 400 or higher. An empty list after both attempts is “No headers returned.” Other failures may show as “Failed to fetch headers.” Fetch is not live: you click Fetch or press Enter.
Is the request private?
DiffCheck does not store the URL, but the target site and, on fallback, api.allorigins.win receive it. Do not inspect URLs you would not be comfortable requesting from your network or sharing with that proxy. Availability depends on the target (and on the proxy when it is used).
Related tools and guides
References
- The Fetch standard’s CORS rules limit which response headers a browser may expose to JavaScript after a cross-origin request. That is why a successful direct lookup can still be a short list.
- allorigins is the proxy used when the direct HEAD request does not yield headers. This page reads the proxy HTTP response headers, which may not match the origin’s full header set.